Citrix urges admins to patch new NetScaler flaws as soon as possible

Citrix warned of two vulnerabilities in NetScaler ADC and NetScaler Gateway — CVE-2026-19490, an authentication-bypass issue affecting appliances configured with SAML Action or as AAA/Gateway vservers, and CVE-2026-19489, a high-severity memory overflow leading to DoS when SIP ALG is enabled on large-scale NAT groups. The bulletin gives configuration strings administrators can search to detect vulnerable appliances, lists fixed firmware builds to upgrade to, and notes that while these flaws have not yet been reported exploited, Citrix urged immediate patching given recent rapid exploitation of other NetScaler CVEs and the large number of exposed instances online.