Which Citrix NetScaler versions are affected by CVE-2026-19489/19490?

The vulnerabilities affect Citrix NetScaler ADC and NetScaler Gateway versions 12.x, 13.x, and 14.x prior to the latest build released September 9, 2026. Citrix has shipped patched versions: NetScaler ADC 14.1-43.50 and later, 13.1-58.32 and later, 12.1-FIPS-76.30 and later (when applicable). NetScaler ADC is the application delivery controller; NetScaler Gateway is the SSL VPN product. Both are deployed by thousands of enterprises for remote access and application delivery (Citrix Security Bulletin, September 9, 2026; Triskelelabs, September 9, 2026).

What should I do if my Citrix NetScaler is exposed to CVE-2026-19489?

Immediately patch NetScaler ADC and Gateway to the latest fixed build (14.1-43.50+, 13.1-58.32+, or 12.1-FIPS-76.30+). Audit NetScaler admin access logs for the period August 25, 2026 through September 9, 2026 for any unexpected admin logins or configuration changes. The authentication bypass allows full admin access without credentials, so any exposed appliance should be considered potentially compromised. Rotate all admin credentials. Review VPN session logs for suspicious activity. Disable management interface access from the public internet if possible (Citrix Security Bulletin, September 9, 2026).

Has CISA added CVE-2026-19489/19490 to the Known Exploited Vulnerabilities catalog?

As of the September 12, 2026 publication of this post, CISA has not yet added CVE-2026-19489 or CVE-2026-19490 to the Known Exploited Vulnerabilities catalog. Given the unauthenticated authentication bypass vector, it is highly likely CISA will add them within days. Organizations should treat them as if they were already in KEV and patch immediately — the alternative is to wait for confirmation of in-the-wild exploitation, which may be too late. CISA's KEV catalog is updated frequently; check the catalog daily until these CVEs are added (CISA Known Exploited Vulnerabilities catalog, September 12, 2026).

What is the difference between NetScaler ADC and NetScaler Gateway?

Citrix NetScaler ADC (Application Delivery Controller) is the platform product: load balancing, content switching, application firewall, and SSL offload. Citrix NetScaler Gateway is the SSL VPN product: secure remote access for end users. Both products share the same underlying platform code base, which is why the same vulnerabilities affect both. In production deployments, ADC is typically the perimeter load balancer and Gateway is the VPN front-end. Both are commonly exposed to the internet for remote-worker access — making authentication bypass vulnerabilities particularly severe (Citrix, 2026).

Are there mitigations if I cannot patch immediately?

Citrix recommends patching as the only complete mitigation. Temporary mitigations: (1) Disable the management interface on public-facing NetScaler appliances (management interface should be on a private VLAN or behind a bastion). (2) Enable NetScaler's Web App Firewall (WAF) for additional application-layer defenses. (3) Use AAA authentication with multi-factor on admin access. (4) Implement IP allow-listing on the management interface. (5) Review NetScaler configuration for any unauthorized changes from the August 25 to September 9 window. None of these mitigations fully address CVE-2026-19489's authentication bypass; patching is required (Citrix Security Bulletin, September 9, 2026; Triskelelabs, September 9, 2026).

Citrix NetScaler CVE-2026-19489 19490 Auth Bypass

Published September 12, 2026 — Fort Lauderdale, Florida. Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway were disclosed on September 9, 2026 by Triskelelabs: CVE-2026-19489 (authentication bypass) and CVE-2026-19490 (memory overflow). Both vulnerabilities allow unauthenticated attackers to compromise the appliance. Organizations using NetScaler for remote access or application delivery should patch immediately.

Data last verified September 12, 2026 from the Citrix Security Bulletin released September 9, 2026, Triskelelabs technical advisory, and CISA Known Exploited Vulnerabilities catalog.

CVE-2026-19489 and CVE-2026-19490 are two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, disclosed by Triskelelabs on September 9, 2026. CVE-2026-19489 is an authentication bypass allowing unauthenticated attackers to gain administrative access. CVE-2026-19490 is a memory overflow potentially enabling remote code execution. Both vulnerabilities affect NetScaler ADC and Gateway versions 12.x, 13.x, and 14.x prior to the latest patched builds released September 9. Citrix's fixed versions: 14.1-43.50+, 13.1-58.32+, 12.1-FIPS-76.30+. Patch immediately (Citrix Security Bulletin, September 9, 2026; Triskelelabs, September 9, 2026).

Affected versions and fixed builds

Product	Affected versions	Fixed build
NetScaler ADC 14.1	14.1 < 14.1-43.50	14.1-43.50 and later
NetScaler ADC 13.1	13.1 < 13.1-58.32	13.1-58.32 and later
NetScaler ADC 12.1-FIPS	12.1-FIPS < 12.1-FIPS-76.30	12.1-FIPS-76.30 and later
NetScaler Gateway 14.1	14.1 < 14.1-43.50	14.1-43.50 and later
NetScaler Gateway 13.1	13.1 < 13.1-58.32	13.1-58.32 and later
NetScaler Gateway 12.1-FIPS	12.1-FIPS < 12.1-FIPS-76.30	12.1-FIPS-76.30 and later

Source: Citrix Security Bulletin (September 9, 2026); Triskelelabs advisory (September 9, 2026).

Citrix typically supports the current GA build and one prior major version (so 14.1 and 13.1). NetScaler 12.1-FIPS is the FIPS 140-2 compliant build for US federal and regulated-industry deployments; it has a separate patch track. Customers on 12.1 non-FIPS or earlier should be on a supported upgrade path (Citrix, 2026).

How CVE-2026-19489 (authentication bypass) works

The authentication bypass allows an unauthenticated remote attacker to gain administrative access to the NetScaler appliance. While the full technical details are typically disclosed after 30 days under coordinated disclosure, the impact is severe: full administrative control of the appliance, including:

Configuration changes — VPN policies, SSL certificates, AAA settings, traffic-management rules.
Session hijacking — active VPN sessions can be intercepted or terminated.
Pivot to backend systems — NetScaler terminates SSL/TLS and proxies traffic to backend application servers; an attacker can potentially intercept or modify backend traffic.
Credential extraction — NetScaler stores admin credentials, AAA configuration, and (when configured) client certificate data.

The simplicity of exploitation (no credentials, no user interaction) and the high impact (full admin) make this a top-priority patch (Citrix Security Bulletin, September 9, 2026).

How CVE-2026-19490 (memory overflow) works

The memory overflow is a separate but related vulnerability. Memory overflow bugs typically allow:

Remote code execution — with a crafted payload, the attacker can execute arbitrary code on the NetScaler host.
Denial of service — a simpler exploit can crash the appliance, disrupting VPN access for all users.
Privilege escalation — combined with CVE-2026-19489, the attacker can chain exploits for deeper compromise.

Memory overflows in VPN appliances are particularly dangerous because the appliance is typically internet-facing and the overflow is reachable pre-authentication. Citrix has not yet disclosed whether CVE-2026-19490 is exploitable without authentication (Triskelelabs, September 9, 2026).

Immediate actions for IT and security teams

Inventory all Citrix NetScaler ADC and Gateway appliances in your environment. Use the configuration management database or run a discovery scan.
Identify versions on each appliance. Log into the management interface and check the build version against the fixed-build matrix above.
Patch unpatched appliances within 24 hours. Citrix's standard patch SLA for critical CVEs is 30 days; for this CVE, treat it as 24 hours given the severity.
Audit admin access logs from August 25, 2026 through the patch date for any unexpected admin logins, especially from unfamiliar IPs or geographies.
Audit configuration changes during the same window. Look for changes to VPN policies, AAA configuration, SSL certificates, and admin accounts.
Rotate credentials — admin passwords, AAA shared secrets, SSL private keys.
Review VPN session logs for active sessions during the exposure window. Terminate any suspicious sessions.

Organizations using managed NetScaler services should contact their Citrix partner or MSP to confirm patching has occurred (Citrix, 2026).

Temporary mitigations if patching is delayed

Citrix's official guidance: patching is the only complete mitigation. However, if patching is operationally difficult in the next 24 hours (for example, in a complex change-management environment), these mitigations reduce exposure:

Disable public management access — move the management interface to a private VLAN behind a bastion host.
IP allow-listing on the management interface — restrict admin access to known corporate IPs.
Enable multi-factor authentication for admin access. This addresses some authentication bypass vectors but not all — CVE-2026-19489 may bypass MFA entirely.
Activate WAF (Web Application Firewall) on NetScaler for application-layer filtering.
Network segmentation — ensure the NetScaler management network is isolated from other critical infrastructure.
Enhanced monitoring — increase SIEM alerting for any NetScaler admin actions, configuration changes, or unusual API calls.

These mitigations reduce the attack surface but do not eliminate CVE-2026-19489's authentication bypass. Patching remains required (Triskelelabs, September 9, 2026).

Citrix NetScaler exploitation history

Citrix NetScaler has been a frequent target for ransomware groups and nation-state actors. Notable prior incidents:

CVE-2023-3519 (July 2023) — critical RCE in NetScaler ADC and Gateway, exploited by APT actors. CISA added to KEV with a 30-day deadline.
CVE-2025-6543 (June 2025) — memory overflow leading to unintended control flow and denial of service.
CVE-2025-5777 (June 2025) — improper restriction of operations within bounds of a memory buffer, exposed session data.

These incidents highlight why NetScaler patching is high-priority. The September 9, 2026 disclosure continues the pattern (Citrix Security Bulletins; CISA KEV catalog, 2023-2026).

FAQ

What is the CVSS score for CVE-2026-19489 and CVE-2026-19490?
Both vulnerabilities are rated Critical by Citrix. The specific CVSS vector and score are pending public disclosure in some cases; Triskelelabs' advisory will publish full details (Triskelelabs, September 9, 2026).

Is NetScaler VPX (virtual) affected the same as MPX (hardware)?
Yes. NetScaler ADC and Gateway run the same software across hardware (MPX), virtual (VPX), and containerized (CPX) platforms. The vulnerabilities affect all form factors running the affected software versions (Citrix, 2026).

How does this compare to the Citrix Bleed vulnerability (CVE-2025-5777)?
CVE-2025-5777 ('Citrix Bleed') was a memory disclosure vulnerability that leaked session tokens, exploited by ransomware gangs for session hijacking. CVE-2026-19489 is an authentication bypass — a different class of vulnerability, but both allow attackers to gain access without valid credentials. Both are critical, but the September 2026 vulnerabilities include a memory overflow that may enable remote code execution, making them potentially more severe (CISA; Citrix, 2025-2026).