SB2026081986 - Two vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway

Description

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2026-19489)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in the SIP ALG processing component when handling SIP ALG traffic on a Large Scale NAT group configuration. A remote attacker can send crafted network traffic to cause a denial of service.

Only appliances with SIP ALG enabled on a Large Scale NAT group configuration are vulnerable.

2) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-19490)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to authentication bypass using an alternate path in the Gateway or AAA virtual server authentication functionality when handling authentication requests. A remote attacker can use an alternate path to bypass authentication.

The issue is exposed only on appliances configured as a Gateway or an AAA virtual server, and on certain versions only when configured with a SAML action.

Remediation

Install update from vendor's website.

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939
• https://support.citrix.com/support-home/topic-article-list?trendingCategory=20&trendingTopicName=Security%20Bulletin