{"id":2460,"date":"2026-08-20T15:44:54","date_gmt":"2026-08-20T15:44:54","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2460"},"modified":"2026-08-20T15:44:54","modified_gmt":"2026-08-20T15:44:54","slug":"critical-netscaler-flaw-can-bypass-authentication-on-certain-gateway-and-aaa-servers","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2460","title":{"rendered":"Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Aug 20, 2026<\/span><\/span><span class=\"p-tags\">Network Security \/ Enterprise Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgoCXrYMA_j7aJrrdIZKt2gQwTWYXhhHZTfBvrNcgpLLBTa5hzcmDNguBKwBhiD8p7kO5K2OeQYVbIPg2HHDBwu9LNzR6oAFE-znmFWIgjY_XzA0qdy-rA8XzV_uGvsxLWRNXCyyOlUKdDV0LGrXPN15wxYsTuZslyecGQ1cqE2OKdX5cocpp74uXenwdj0\/s1700-e365\/citrix.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Citrix has <a href=\"https:\/\/community.citrix.com\/techzone-blogs\/110_security-updates\/security-update-netscaler-adc-and-netscaler-gateway-vulnerabilities-r1602\/\" target=\"_blank\">released<\/a> updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability.<\/p>\n<p>According to the cloud computing and virtualization technology company, the issues <a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX696939\" target=\"_blank\">affect<\/a> customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess ZTNA Hybrid deployments that use customer-managed NetScaler instances.<\/p>\n<p>It bears noting that the vulnerabilities do not apply to Citrix-managed cloud services or Citrix-managed Adaptive Authentication, as the necessary updates have already been applied. The list of impacted NetScaler versions is below &#8211;<\/p>\n<ul>\n<li>NetScaler ADC and NetScaler Gateway\u202f14.1\u202fBEFORE 14.1-73.32 <\/li>\n<li>NetScaler ADC and NetScaler Gateway\u202f13.1\u202fBEFORE 13.1-63.21 <\/li>\n<li>NetScaler ADC FIPS BEFORE 14.1-73.32 FIPS <\/li>\n<li>NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.277 <\/li>\n<\/ul>\n<p>The first of the two vulnerabilities is CVE-2026-19489 (CVSS score: 8.8), a memory overflow vulnerability that may lead to unpredictable behavior or denial-of-service (DoS). However, it applies only when Session Initiation Protocol Application Layer Gateway (SIP ALG) is enabled on a Large Scale NAT (LSN) group configuration.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/zero-trust-claude-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj8iAp2j8rqTq6aptj6yiYHC-B73UxnWI2NQMt0azp6OVLq9JkO8cpYokLWa8t_IKqrHKPsaM5D_lQ9Ip7kZTi3at4oYfzN1m1b_T4b6MuzBWtmlhdLcQ0nZHicD94rliREFDRewsKBQCTYrAAVNzYKj84_0EZskDUxvkc972s9fYAqcQGEQjVZTc0cr7TB\/s728-e100\/ThreatLocker-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>CVE-2026-19490 (CVSS score: 9.3), the more severe of the two, is an authentication bypass vulnerability that affects appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, assuming the following version-specific requirements are met &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<ul>\n<li>14.1-43.56 or later &#8211; Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver<\/li>\n<li>14.1-66.68-FIPS or later &#8211; Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver<\/li>\n<li>14.1-43.55 or earlier &#8211; Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy ) or AAA vserver<\/li>\n<li>13.1-61.28 or later &#8211; Applicable only when configured with a SAML action<\/li>\n<li>13.1-61.27 or earlier &#8211; Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)  or AAA vserver<\/li>\n<li>13.1 FIPS &#8211; Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver<\/li>\n<\/ul>\n<p>\u00abCustomers should also review their configurations to determine whether the documented preconditions apply,\u00bb Citrix said. \u00abPrioritization should be based on exposure, deployment role, and whether the affected configuration is enabled.\u00bb<\/p>\n<p>For CVE-2026-19489, customers can check if their device meets the precondition by inspecting their NetScaler configuration for the specified string &#8211;<\/p>\n<p>Similarly, for CVE-2026-19490, customers can verify their NetScaler configuration for the below string &#8211;<\/p>\n<ul>\n<li>add authentication samlAction.* (SAML action configuration)<\/li>\n<li>add authentication vserver .* or add vpn vserver .* (for AAA or VPN vserver)<\/li>\n<\/ul>\n<p>\u00abAdditionally, this vulnerability can be mitigated by using signatures if you are using NetScaler Console (Service or on-prem) and if the NetScaler firmware version is higher than 14.1-60.52 and 13.1-63.16 or higher, which have a feature called <a href=\"https:\/\/community.citrix.com\/techzone-blogs\/netscaler\/netscaler-global-deny-list-always-on-protection-for-the-threats-you-havent-modeled-yet-r1254\/#2_Unconditional_evaluation_in_the_request_pipeline__3e5a90\" target=\"_blank\">Global Deny Lists<\/a> that consumes the signatures and automatically applies the signatures to NetScaler appliances managed via NetScaler Console,\u00bb Citrix said. \u00abThe feature is enabled by default.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The updates are available in the following versions &#8211;<\/p>\n<ul>\n<li>NetScaler ADC and NetScaler Gateway 14.1-73.32 or later<\/li>\n<li>NetScaler ADC and NetScaler Gateway 13.1-63.21 or later <\/li>\n<li>NetScaler ADC FIPS 14.1-73.32 FIPS or later<\/li>\n<li>NetScaler ADC FIPS and NDcPP 13.1-37.277 or later <\/li>\n<\/ul>\n<p>Citrix has credited Samarth Vashisht from the pen-test team at JPMorgan Chase for discovering and reporting the flaws. Although there is no evidence that the shortcomings have been exploited in the wild, newly disclosed Citrix vulnerabilities have been a lucrative target for attackers.<\/p>\n<p>Last month, an insufficient input validation vulnerability in NetScaler ADC and NetScaler Gateway (CVE-2026-8451, CVSS score: 8.8) witnessed active exploitation efforts less than 24 hours of public disclosure.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Aug 20, 2026Network Security \/ Enterprise Security Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability.&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2461,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3100,396,394,58,70,1722,842,777],"class_list":["post-2460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-aaa","tag-authentication","tag-bypass","tag-critical","tag-flaw","tag-gateway","tag-netscaler","tag-servers"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2460"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2461"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}