Critical Security Advisory – NetScaler ADC & NetScaler Gateway Vulnerabilities (CVE-2026-19490 & CVE-2026-19489)

We'd like to make you aware of multiple critical security vulnerabilities recently disclosed by Broadcom (VMSA-2026-0006) affecting VMware vCenter Server and VMware ESX/ESXi. Two of these carry a CVSS score of 9.8 and could allow an attacker with network access to fully compromise your vCenter, so we recommend prompt attention.

Summary of the Vulnerabilities:

• CVE-2026-19490 (CVSS 9.3, Critical) – An authentication bypass ("Authentication Bypass Using an Alternate Path"). A remote, unauthenticated attacker could circumvent authentication on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. On newer builds (14.1-43.56+ and 13.1-61.28+) the flaw is only exploitable when a SAML action is configured; on earlier builds, any Gateway or AAA vserver configuration is enough to be exposed.

   

• CVE-2026-19489 (CVSS 8.8, High) – A memory overflow ("Improper Restriction of Operations within the Bounds of a Memory Buffer") that could lead to a denial-of-service condition. This one requires SIP ALG to be enabled within a Large Scale NAT (LSN) group configuration.

   

• Important: This bulletin applies only to customer-managed NetScaler ADC and NetScaler Gateway. Citrix-managed cloud services and Adaptive Authentication have already been patched and require no action.

   

What's Affected:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-63.21
• NetScaler ADC 14.1-FIPS before 14.1-73.32-FIPS
• NetScaler ADC 13.1-FIPS / 13.1-NDcPP before 13.1-37.277
• Note: NetScaler ADC and NetScaler Gateway 13.0 and earlier are End-of-Life (EOL) and should be considered vulnerable — upgrade planning is strongly recommended.

Recommended Action:

We strongly encourage reviewing your environment to identify affected appliances and upgrading to one of the fixed builds below (or later) as soon as possible:

• NetScaler ADC and NetScaler Gateway 14.1-73.32 and later

• NetScaler ADC and NetScaler Gateway 13.1-63.21 and later

• NetScaler ADC 14.1-FIPS 14.1-73.32-FIPS and later

• NetScaler ADC 13.1-FIPS / 13.1-NDcPP 13.1-37.277 and later

Because NetScaler appliances typically sit at the network perimeter and Citrix authentication-bypass flaws are historically targeted quickly once disclosed, we recommend treating this as an emergency patch rather than routine maintenance. There is no evidence of exploitation in the wild at the time of writing, but that can change rapidly.

At Kyocera, we understand the critical importance of securing your infrastructure. If you need assistance in reviewing or resolving this issue, please don't hesitate to contact our team. You can reach our helpdesk at help@dau.kyocera.com