Vulnerability
High-severity memory overflow in NetScaler that can cause unexpected behavior or denial-of-service when SIP ALG is enabled at an LSN group configuration.
Citrix's critical NetScaler flaw CVE-2026-19490 is exploitable only on appliances running a Gateway or AAA virtual server role, a DEV Community analysis of the advisory says. The other August flaw depends on a different setting, so role sets the patch order.
Reality
watchTowr says attackers exploited two remote code execution flaws in Citrix NetScaler ADC and Gateway before any fix existed. The August patch for CVE-2026-19490 fixes a different bug, so every operator now has to decide whether to keep the box online and whether to assume it is breached.
Perspective Coverage
3 publishersReality
CVE-2026-19490 lets an unauthenticated attacker past NetScaler gateway and AAA virtual servers. Rapid7 has seen no exploitation yet and expects it shortly.
Perspective Coverage
5 publishersReality
Vidar, LummaC2, RedLine and Atomic Stealer are pulling session material that authenticates without a login prompt, so the usual reset-and-enroll response can leave the intruder inside and spending the victim's paid usage.
Reality
Citrix shipped fixes on 19 August 2026 for a memory overflow and an authentication bypass in NetScaler ADC and Gateway, but each one needs particular features turned on, so the inventory has to come before the change window.
Reality