Full research report
Citrix urges admins to patch new NetScaler flaws as soon as possible
Executive assessment
Citrix's August 2026 advisory introduces two new unexploited vulnerabilities — CVE-2026-19490 (CVSS 9.3 authentication bypass) and CVE-2026-19489 (CVSS 8.8 memory overflow DoS) — but its urgency is grounded in a demonstrably short exploitation lag: the March 2026 companion flaws CVE-2026-3055 ('CitrixBleed 3') and CVE-2026-4368 were confirmed exploited within four days of patching, with watchTowr and Defused observing attacks on honeypots and CISA responding with a three-day federal remediation order under BOD 22-01. CVE-2026-19490's precondition — SAML Action configured on a Gateway or AAA virtual server — is common in enterprise single sign-on environments, widening the realistic exposure beyond narrow or edge deployments. With over 22,000 NetScaler ADC instances exposed on the internet, no documented workarounds, and no public PoC yet circulating, the defensive window is likely measured in days rather than weeks. Organisations should treat the 14.1-73.32 and 13.1-63.21 fixed builds as emergency updates, prioritising SAML-configured and internet-facing appliances first.
What happened
On 20 August 2026, Citrix published security bulletin CTX696939 disclosing two new vulnerabilities in NetScaler ADC and NetScaler Gateway: CVE-2026-19490, a critical (CVSS v4.0 9.3) authentication bypass, and CVE-2026-19489, a high-severity (CVSS v4.0 8.8) memory overflow that enables denial of service. Neither has been observed exploited in the wild as of the advisory date, and no public proof-of-concept code is known to exist. Citrix explicitly contextualised the urgency by referencing two prior flaws — CVE-2026-3055 and CVE-2026-4368 — which were patched in March 2026 and saw confirmed exploitation within four days, with CVE-2026-3055 subsequently added to the CISA Known Exploited Vulnerabilities catalogue on 30 March 2026 and a three-day federal remediation deadline imposed.
Affected scope
NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, including FIPS and NDcPP builds. CVE-2026-19490 requires the appliance to be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server with SAML Action configured. CVE-2026-19489 requires SIP ALG to be enabled on a large-scale NAT group. SecurAccess ZTNA Hybrid deployments using customer-managed NetScaler instances are also in scope. ShadowServer tracks over 22,000 NetScaler ADC and nearly 1,800 NetScaler Gateway instances exposed to the internet.
Technical assessment
CVE-2026-19490 (CWE-288, authentication bypass via alternate path) allows a remote unauthenticated attacker to circumvent authentication controls on NetScaler appliances in Gateway or AAA virtual server roles where a SAML Action is configured — configurations common in enterprise single sign-on environments. The CVSS 9.3 score reflects network-reachable exploitation with no credentials or user interaction required. CVE-2026-19489 (CWE-119, improper restriction of memory buffer operations) triggers a memory bounds violation in SIP ALG processing on large-scale NAT groups, producing unpredictable process behaviour or denial of service accessible without authentication. The contextual precedent — CVE-2026-3055, dubbed 'CitrixBleed 3', leaked session tokens, SAML assertions, and LDAP credentials from process memory via two distinct request primitives exploitable within days of the patch — establishes a clear pattern: Citrix perimeter appliance vulnerabilities are rapidly weaponised.
Recommended defensive actions
- Immediately upgrade all customer-managed NetScaler ADC and Gateway instances to 14.1-73.32 or 13.1-63.21 (or the corresponding FIPS/NDcPP builds), as Citrix documents no workarounds for either CVE
- Audit all NetScaler configurations for the SAML Action string ('add authentication samlAction .*') combined with Auth/VPN vserver strings to confirm CVE-2026-19490 exposure before prioritising upgrade sequencing
- Audit configurations for SIP ALG on large-scale NAT groups ('add lsn group.*sipalg.*') to identify CVE-2026-19489 exposure; disable SIP ALG on LSN groups where it is not operationally required
- Inventory all internet-exposed NetScaler ADC and Gateway instances using ShadowServer data and internal asset registers; treat perimeter-facing appliances as the highest-priority upgrade targets
- Subscribe to CISA KEV notifications so that any confirmed exploitation of CVE-2026-19489 or CVE-2026-19490 triggers an immediate escalation protocol
Uncertainties and evidence gaps
- No public proof-of-concept code has been published for CVE-2026-19490 or CVE-2026-19489; the ease of independent exploitation without internal knowledge of the patch diff is unconfirmed
- The precise authentication bypass mechanism for CVE-2026-19490 has not been publicly documented, so the real-world exploitability and attack surface width remain unverified
- ShadowServer's count of 22,000+ exposed NetScaler ADC instances does not distinguish patched from unpatched builds or identify configurations meeting CVE-specific preconditions; the true vulnerable population is unknown
- SecurityAffairs' initial reporting on CVE-2026-3055 described no documented in-the-wild exploits, contradicting Picus Security and Cybersecurity Dive reporting of confirmed exploitation from 27 March 2026; the latter two sources align with CISA's KEV addition and are assessed as more authoritative
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation of CVE-2026-19489 or CVE-2026-19490 as of 20 August 2026; Rapid7 assesses exploitation highly likely given Citrix products' track record as perimeter targets. CVE-2026-3055, a prior related flaw, was previously exploited in the wild from approximately 27 March 2026 and is listed in CISA KEV (added 30 March 2026).
The investigation began by verifying the BleepingComputer article against the official Citrix bulletin and independent security vendor analysis to confirm the scope, severity, and exploitation status of four CVEs across two separate advisory events. The two new flaws (CVE-2026-19490 and CVE-2026-19489) are unexploited but carry strong indicators of near-term targeting, supported by Rapid7 and SecurityWeek assessments and the four-day patch-to-exploit precedent set by CVE-2026-3055 in March 2026. Evidence from five independent sources across vendor advisories, security research, and government-linked reporting supports a high-confidence assessment.
- Does the BleepingComputer article accurately represent the vulnerability details, affected products, and exploitation context?Fetched the BleepingComputer article to extract CVE IDs, affected products, patch versions, configuration preconditions, and exploitation framingbleepingcomputer.com ↗
Article accurately describes CVE-2026-19490 as a SAML-preconditioned authentication bypass and CVE-2026-19489 as a SIP ALG memory overflow; references CVE-2026-3055 and CVE-2026-4368 as prior exploited flaws patched in March 2026; cites 22,000+ exposed instances from ShadowServer
why Established the four CVEs requiring independent verification and confirmed article framing was consistent with expected Citrix advisory content before seeking primary sources
- What do primary vendor sources confirm about CVE-2026-19489 and CVE-2026-19490 severity, scope, and remediation?Fetched the official Citrix security bulletin CTX696939support.citrix.com ↗
Confirmed CVSS v4.0 9.3 for CVE-2026-19490 (CWE-288) and 8.8 for CVE-2026-19489 (CWE-119); fixed versions confirmed as 14.1-73.32 and 13.1-63.21; no workarounds documented; no exploitation flagged at time of publication
why Primary vendor bulletin is the authoritative source for severity, scope, and patch targets; confirmed article claims and established that no mitigations exist short of patching
- Do independent security researchers corroborate the CVE details and assess exploitation likelihood?Fetched Rapid7's emergency threat response post for CVE-2026-19490 and SecurityWeek's coveragerapid7.com ↗
Rapid7 confirms no observed exploitation as of 19 August 2026 but assesses exploitation highly likely; SecurityWeek independently corroborates technical details and forecast
why Two independent vendor assessments from established security firms provide corroboration of the bulletin's technical claims and an explicit forward-looking exploitation probability assessment
- What is the technical mechanism of CVE-2026-3055 and CVE-2026-4368, and when did exploitation begin?Fetched Picus Security's in-depth technical analysis of CVE-2026-3055 and CVE-2026-4368picussecurity.com ↗
CVE-2026-3055 ('CitrixBleed 3', CVSS 9.3) exploits two distinct request primitives against SAML and WS-Federation endpoints to read process memory via base64-encoded NSC_TASS cookie responses, leaking session tokens, SAML assertions and LDAP credentials; exploitation confirmed from approximately 27 March 2026; CISA KEV addition 30 March 2026
why Establishes the data-disclosure severity and rapid weaponisation of the prior flaw, directly informing why the August 2026 advisory carries emergency-level urgency for unexploited but related vulnerabilities
- Which researchers confirmed CVE-2026-3055 exploitation, and does this corroborate the four-day patch-to-exploit claim?Fetched Cybersecurity Dive's reporting on confirmed NetScaler exploitationcybersecuritydive.com ↗
watchTowr and Defused researchers confirmed active exploitation of CVE-2026-3055 on honeypots beginning 27 March 2026, four days after Citrix's 23 March patch advisory; CISA added CVE-2026-3055 to KEV on 30 March 2026
why Corroborates the BleepingComputer article's claim that exploitation began days after patching and names the specific researchers, providing independent sourcing for the precedent pattern
Research coverage
All 68 registered source leaves were evaluated for this run: 55 completed, 0 were unavailable, 6 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 51 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok8 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA KEVkev | ok1673 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| Rapid7news | ok empty0 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok686 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: exploitresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: penetration-testingresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: pocresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GitHub topic: vulnerabilityresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories1
Primary Citrix bulletin confirming CVSS scores, affected and fixed versions, configuration preconditions, and absence of documented workarounds
Analysis & research4
Confirms no observed exploitation as of 19 August 2026; assesses exploitation likely given Citrix perimeter products' historical targeting pattern
Independent corroboration of CVE-2026-19490 technical details and analyst forecast of near-term exploitation attempts
Detailed analysis of the prior exploited flaws: two exploitation primitives, leaked data types (session tokens, SAML assertions, LDAP credentials), and exploitation timeline
Confirms CVE-2026-3055 exploitation observed from 27 March 2026 by watchTowr and Defused researchers on honeypots; corroborates four-day patch-to-exploit window