{"id":9204,"date":"2026-08-20T18:54:09","date_gmt":"2026-08-20T18:54:09","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9204"},"modified":"2026-08-20T18:54:09","modified_gmt":"2026-08-20T18:54:09","slug":"citrix-issues-critical-security-updates-for-its-netscaler-devices","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9204","title":{"rendered":"Citrix issues critical security updates for its NetScaler devices"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Citrix is urging its NetScaler ADC and NetScaler Gateway customers to quickly patch two critical security holes, one involving a memory overflow vulnerability leading to unpredictable behavior or denial of service, and the other allowing authentication bypass.<\/p>\n

Citrix said in an advisory<\/a> that supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments that use customer-managed NetScaler instances, are affected. Citrix-managed cloud services and Citrix-managed Adaptive Authentication have already been updated.<\/p>\n

However, it added, \u201cat this point [August 19] the NetScaler images available on cloud marketplaces (AWS, Azure, GCP) have not been updated. If you need to update the images to the versions containing the fix, please download them from Citrix downloads<\/a> page.\u201d<\/p>\n

Analysts and cybersecurity consultants agreed that these patches should be urgently applied, given the sensitive and risky nature of gateways.\u00a0<\/p>\n

In fact, noted Charlie Winckless<\/a>, VP\/analyst at Gartner, his firm now identifies the increase in perimeter threats \u201cas the highest signal as used by threat actors,\u201d with internet-exposed appliances the most critical. \u201cIn the past,\u201d he said, \u201cnew Citrix issues have been exploited rapidly by attackers due to their location in the application path.\u201d<\/p>\n

Of the two flaws, \u201cthe authentication bypass [CVE-2026-19490<\/a>] is the one that should make people move tonight,\u201d said cybersecurity consultant Brian Levine<\/a>, executive director of FormerGov. \u201cNetScaler sits at the network edge, facing the internet, and a critical-rated, pre-authentication bypass on an edge appliance is about as high-value as a target gets.\u201d <\/p>\n

And because authentication bypasses in Citrix gateways are almost always weaponized, and usually quickly, he said, \u201cI suggest organizations patch the authentication bypass on an emergency basis, not on their normal maintenance cycle.\u201d<\/p>\n

Levine added that this is not a \u201cpatch and you\u2019re done\u201d situation; defenders also need to rotate credentials, kill active sessions, and hunt for signs of prior access before they close the incident.<\/p>\n

\u201cA CVSS 9.3 means a remote attacker with no credentials and no user interaction can defeat the login on a device whose entire job is to be a secure front door,\u201d he said. \u201cIf you\u2019re running it as a Gateway or AAA virtual server, you have to assume this is a \u2018when,\u2019 not an \u2018if.\u2019\u201d<\/p>\n

Fritz Jean-Louis<\/a>, principal cybersecurity advisor at Info-Tech Research Group, echoed Levine\u2019s concerns.\u00a0<\/p>\n

\u201cEven when a vulnerability is rated lower than a remote code execution flaw, organizations should not underestimate the risk when it affects a security gateway,\u201d Jean-Louis said. The vulnerability \u201ccan\u2019t just be added to the patch queue, because it has the potential to undermine one of the controls organizations depend on to keep unauthorized users out.\u201d<\/p>\n

Mike Wilkes<\/a>, enterprise CISO at Aikido Security, added that rapid application of these fixes is crucial now that the announcement has alerted attackers to the flaws. That means it\u2019s a race to see who acts the fastest: the good guys or the bad guys.\u00a0<\/p>\n

\u201cThere are no public indicators that these two new flaws are being exploited at the moment, but that is likely to change within hours, given the ability of threat actors to weaponize the update patch to discern the exploit details,\u201d he said, given that a CVSS 9.3 authentication bypass flaw on a NetScaler Gateway or AAA server is precisely the kind of vulnerability defenders do not want sitting on an internet-facing boundary, because a successful exploit could allow unauthorized access to resources behind the gateway, followed by credential or session abuse, reconnaissance, lateral movement and ultimately data theft or broader compromise.<\/p>\n

The second major hole flagged by Citrix, CVE-2026-19489<\/a>, with an 8.8 CVSS score, is less of a concern but still worrisome, he noted.\u00a0<\/p>\n

\u201cIt requires SIP ALG to be enabled on a large-scale NAT group, so the vulnerable population should be considerably smaller,\u201d Wilkes said. \u201cNevertheless, a remotely triggerable memory overflow capable of producing unpredictable behavior or denial of service is consequential on infrastructure whose purpose is keeping applications and remote users connected. An attacker does not necessarily need to steal data for an attack to be damaging: repeatedly destabilizing or crashing an ADC or gateway can interrupt VPN access, customer-facing applications and other dependent services at precisely the moment an organization needs them.\u201d<\/p>\n

In addition, Wilkes said, CISOs should be worried about the \u201caccumulated risk history around NetScaler and Citrix edge infrastructure.\u201d<\/p>\n

\u201cCISA has flagged 22 Citrix vulnerabilities as known exploits over the last five years, six of them associated with ransomware,\u201d he pointed out. \u201cThat history matters because attackers have repeatedly demonstrated that they understand the strategic value of these perimeter systems and know how to abuse them. The risk calculation is not simply the theoretical severity of CVE-2026-19489 or CVE-2026-19490. It is the combination of serious vulnerability classes, internet exposure, privileged network position and a demonstrated adversary appetite for weaponizing Citrix flaws soon after disclosure. There is a hungry population of attackers that has heard the Pavlovian bell ring that it\u2019s feeding time again on Citrix stacks.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Citrix is urging its NetScaler ADC and NetScaler Gateway customers to quickly patch two critical security holes, one involving a memory overflow vulnerability leading to unpredictable behavior or denial of service, and the other allowing authentication bypass. Citrix said in an advisory that supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS […]<\/p>\n","protected":false},"author":0,"featured_media":9205,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9204"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9204"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9204\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9205"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}