Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers 关键 NetScaler 漏洞可在某些网关和 AAA 服务器上绕过身份验证

TL;DR

• Citrix disclosed two critical vulnerabilities in NetScaler ADC and NetScaler Gateway: CVE-2026-19489 (CVSS 8.8, memory overflow/DoS) and CVE-2026-19490 (CVSS 9.3, authentication bypass)
• CVE-2026-19490 allows unauthenticated access on appliances configured as Gateway or AAA virtual servers under specific version and SAML configuration conditions
• Patches are available in NetScaler 14.1-73.32+, 13.1-63.21+, and corresponding FIPS/NDcPP builds
• The vulnerabilities were discovered by Samarth Vashisht from JPMorgan Chase's pen-test team; no active exploitation has been confirmed yet
• NetScaler Console users on firmware above 14.1-60.52 / 13.1-63.16 can mitigate CVE-2026-19490 via the default-enabled Global Deny Lists feature

Why It Matters

Authentication bypass vulnerabilities in widely deployed enterprise gateway appliances like NetScaler are high-priority targets for threat actors, as demonstrated by the rapid exploitation of CVE-2026-8451 just 24 hours after its disclosure last month. Organizations relying on NetScaler for remote access, VPN, and SSO infrastructure must urgently assess their exposure and apply patches to prevent potential unauthorized access to internal resources.

Technical Details

• CVE-2026-19489 (CVSS 8.8): A memory overflow vulnerability triggered only when SIP ALG is enabled on a Large Scale NAT (LSN) group configuration. It can cause unpredictable behavior or denial-of-service. Detection string: add lsn group.*sipalg.*
• CVE-2026-19490 (CVSS 9.3): An authentication bypass affecting Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) and AAA virtual servers. Preconditions vary by version: on 14.1-43.56+ and 13.1-61.28+, a SAML action must be configured; on earlier builds, the vulnerability applies broadly to any Gateway or AAA vserver. Detection strings include add authentication samlAction.* and add authentication vserver .* or add vpn vserver .*
• Affected versions: NetScaler ADC/Gateway 14.1 before 14.1-73.32, 13.1 before 13.1-63.21, FIPS builds before 14.1-73.32 FIPS, and NDcPP builds before 13.1-37.277
• Mitigation: NetScaler Console (Service or on-prem) users on firmware 14.1-60.52+ or 13.1-63.16+ can leverage the Global Deny Lists feature, which is enabled by default and automatically applies protective signatures
• Exclusions: Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not affected as updates were already applied

Industry Insight

• Organizations should immediately audit their NetScaler configurations for the presence of SAML actions, Gateway/AAA vservers, and LSN+SIP ALG combinations to determine actual exposure before patching
• Given the pattern of rapid exploitation seen with CVE-2026-8451, defenders should treat this as an active-threat scenario and prioritize patching for internet-facing NetScaler instances
• The conditional nature of CVE-2026-19490 (dependent on specific version and SAML configurations) highlights the importance of configuration hygiene—many deployments may be unaffected if SAML is not in use, but verification is essential

TL;DR

• Citrix发布安全更新，修复NetScaler ADC和Gateway的两个关键漏洞，包括一个CVSS 9.3分的认证绕过漏洞(CVE-2026-19490)
• 漏洞仅影响特定配置的客户自管理部署，Citrix托管云服务已不受影响
• 受影响版本包括14.1(低于14.1-73.32)和13.1(低于13.1-63.21)，已发布修复版本
• 漏洞由JPMorgan Chase安全团队发现，历史上类似Citrix漏洞在披露后24小时内即遭利用
• 可通过检查配置字符串或使用Global Deny Lists功能进行临时缓解

为什么值得看

对依赖Citrix NetScaler进行远程访问和身份验证的企业IT安全团队至关重要，认证绕过漏洞可能让攻击者直接绕过访问控制。考虑到Citrix产品近期频繁出现高危漏洞且常被快速利用，及时更新和配置检查成为当务之急。

技术解析

CVE-2026-19490是核心漏洞，允许绕过SSL VPN、ICA Proxy、CVPN、RDP Proxy及AAA虚拟服务器的认证机制。该漏洞的利用条件因版本而异：14.1-43.56及以上版本需要同时配置SAML动作和Gateway/AAA vserver，而14.1-43.55及以下版本只需配置Gateway或AAA vserver即可触发。

CVE-2026-19489是内存溢出漏洞，仅在启用SIP ALG的LSN组配置下才会影响系统，可能导致不可预测的行为或拒绝服务。

临时缓解措施包括检查配置中是否存在特定的字符串模式，如LSN组配置中的"add lsn group.sipalg."，或SAML动作配置中的相关标识。对于使用NetScaler Console且固件版本高于14.1-60.52或13.1-63.16的系统，可以启用Global Deny Lists功能来自动应用签名防护。

修复方案要求将NetScaler ADC和Gateway升级到14.1-73.32或更高版本，13.1版本则需升级至13.1-63.21或更高，FIPS版本也有相应的最低版本要求。

行业启示

企业应立即审查NetScaler部署的配置和版本，优先处理暴露在互联网且配置了Gateway或AAA vserver的系统。考虑到Citrix产品近期频繁出现高危漏洞且常被快速利用，建议建立更严格的补丁管理流程，并考虑采用托管服务以降低维护风险。