Citrix Patches High-Severity Flaws in NetScaler ADC, Gateway, and XenServer

Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.

Aug 21, 2026

Citrix NetScaler Flaws Expose ADC and Gateway to Remote DoS and Memory Errors

Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.

Jul 1, 2026

Critical Vulnerabilities Disclosed in Citrix NetScaler ADC and Gateway

Citrix disclosed critical vulnerabilities affecting **NetScaler ADC** and **NetScaler Gateway**, prompting alerts from both the Canadian Centre for Cyber Security and CERT-EU. The issues are tracked as `CVE-2026-3055` and `CVE-2026-4368`, and impact multiple supported release branches, including **14.1**, **13.1**, and **13.1 FIPS/NDcPP** versions running below the vendor’s fixed builds. Affected deployments include standard **NetScaler ADC**, **NetScaler Gateway**, and hardened **FIPS/NDcPP** editions. Government cyber authorities urged organizations to review Citrix’s security bulletin and apply the recommended updates and mitigations without delay. The coordinated advisories indicate broad concern across enterprise and public-sector environments that rely on Citrix application delivery and remote access infrastructure, with administrators advised to identify exposed appliances and move vulnerable systems to patched versions listed by Citrix.

Mar 31, 2026

Citrix Patches High-Severity Flaws in NetScaler ADC, Gateway, and XenServer

How this story unfolded

Citrix releases security updates for XenServer and NetScaler products

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Citrix Patches High-Severity Flaws in NetScaler ADC, Gateway, and XenServer

How this story unfolded

Citrix releases security updates for XenServer and NetScaler products

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Citrix Patches High-Severity Flaws in NetScaler ADC, Gateway, and XenServer

How this story unfolded

Citrix releases security updates for XenServer and NetScaler products

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Authentication Bypass and Overflow Flaws Patched in Citrix NetScaler

Citrix NetScaler Flaws Expose ADC and Gateway to Remote DoS and Memory Errors

Critical Vulnerabilities Disclosed in Citrix NetScaler ADC and Gateway

Citrix Patches High-Severity Flaws in NetScaler ADC, Gateway, and XenServer

How this story unfolded

Citrix releases security updates for XenServer and NetScaler products

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Authentication Bypass and Overflow Flaws Patched in Citrix NetScaler

Citrix NetScaler Flaws Expose ADC and Gateway to Remote DoS and Memory Errors

Critical Vulnerabilities Disclosed in Citrix NetScaler ADC and Gateway