Published · yesterdaySecurity2 min read
22,000 exposed NetScaler ADCs, and no way to scope the risk by build number
ShadowServer counts more than 22,000 NetScaler ADC instances reachable on the internet. Whether the new Citrix authentication bypass touches any of them turns on config lines, not on that count.
Not a builder's beat, but builders have a standing stake in it.See today for builders
What happened
- The ShadowServer Foundation tracks over 22,000 NetScaler ADC and nearly 1,800 NetScaler Gateway instances exposed online, but does not provide information on how many are honeypots or how many may be vulnerable to attacks targeting CVE-2026-19489 and CVE-2026-19490.
- CVE-2026-19490 allows remote unprivileged attackers to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured.
- CVE-2026-19489 is a high-severity memory overflow that remote unauthenticated actors can abuse for denial of service when SIP ALG is enabled on a large-scale NAT group configuration.
- Admins can check exposure to CVE-2026-19490 by inspecting the NetScaler configuration for the SAML action string (add authentication samlAction .*) and the Auth or VPN vserver strings (add authentication vserver .* and add vpn vserver .*).
- Teams can determine whether appliances meet the preconditions for CVE-2026-19489 by inspecting the configuration for the string "add lsn group.*sipalg.*".
Compiled by The WatchSomething wrong?How this is made
Why it matters
ShadowServer's figure is a ceiling on the population, not a measure of the problem, and the foundation says as much: it does not break out honeypots, and it does not say how many tracked boxes are vulnerable to the two new flaws [1]. That gap is not a data-quality footnote. It follows from how both bugs work.
CVE-2026-19490 only reaches an appliance configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), and whether it reaches one depends on the firmware version together with whether SAML Action is configured, according to Citrix [2]. CVE-2026-19489 needs SIP ALG enabled on a large-scale NAT group before an unauthenticated attacker can push it into a denial of service [3]. Citrix's own triage advice is to grep the configuration: the SAML action and vserver strings for the bypass, the LSN group SIP ALG string for the overflow [4][5]. That is an inside-out check. No external scan produces it, which is why the internet-wide count and the affected count are different quantities that no published source connects.
The role dependency cuts against the instinct to discount the bigger pile. ADC instances outnumber Gateway instances in ShadowServer's tracking by roughly twelve to one [1], and the bypass follows the configured role rather than the product name on the box [2]. Citrix also puts SecurAccess ZTNA Hybrid deployments built on customer-managed NetScaler instances in scope for the upgrade [6].
For base rate: CISA has flagged 22 Citrix vulnerabilities as exploited over five years, six of those in ransomware [7], about 27 percent [2].
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The ShadowServer Foundation tracks over 22,000 NetScaler ADC and nearly 1,800 NetScaler Gateway instances exposed online, but does not provide information on how many are honeypots or how many may be vulnerable to attacks targeting CVE-2026-19489 and CVE-2026-19490.
- [2]
CVE-2026-19490 allows remote unprivileged attackers to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured.
ReportedView cited source - [3]
CVE-2026-19489 is a high-severity memory overflow that remote unauthenticated actors can abuse for denial of service when SIP ALG is enabled on a large-scale NAT group configuration.
ReportedView cited source - [4]
Admins can check exposure to CVE-2026-19490 by inspecting the NetScaler configuration for the SAML action string (add authentication samlAction .*) and the Auth or VPN vserver strings (add authentication vserver .* and add vpn vserver .*).
ReportedView cited source - [5]
Teams can determine whether appliances meet the preconditions for CVE-2026-19489 by inspecting the configuration for the string "add lsn group.*sipalg.*".
ReportedView cited source - [6]
Citrix states the bulletin applies to supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, and that SecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments using customer-managed NetScaler instances are also affected and should be upgraded.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- bleepingcomputer.comyesterdayCitrix urges admins to patch new NetScaler flaws as soon as possible
- wiki.zimbra.comyesterdayZimbra Releases/10.1.20 - Zimbra :: Tech Center
- wiki.zimbra.comyesterdayZimbra Security Advisories - Zimbra :: Tech Center
