Cloud Software Group (Citrix) is urging organizations to immediately patch two (2) vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, led by CVE-2026-19490 (CVSS 9.3), a critical authentication bypass that could allow unauthenticated remote attackers to circumvent access controls on systems configured as Gateways or AAA virtual servers. Classified as CWE-288, the flaw exploits an alternate authentication path and requires no privileges or user interaction, potentially exposing protected services delivered through SSL VPN, ICA Proxy, CVPN, and RDP Proxy (affected configurations vary by software version and whether SAML actions are enabled). The second vulnerability, CVE-2026-19489 (CVSS 8.8), is a memory overflow that could enable unauthenticated denial-of-service (DoS) attacks when SIP ALG is enabled in Large Scale NAT configurations. Organizations should upgrade to NetScaler ADC/Gateway 14.1-73.32 or 13.1-63.21 or later, including applicable FIPS and NDcPP builds, while reviewing SAML, AAA, VPN, and authentication telemetry for anomalous sessions or access without expected authentication events. No public proof-of-concept or confirmed exploitation has been reported as of August 20, 2026, but the vulnerabilities warrant urgent remediation because NetScaler appliances frequently sit at the enterprise perimeter and have historically been rapidly targeted after disclosure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified twenty-two (22) Citrix vulnerabilities as exploited in the wild over the past five (5) years, including six (6) used in ransomware attacks. The exposure is substantial, with ShadowServer tracking more than 22,000 internet-facing NetScaler ADC and nearly 1,800 NetScaler Gateway instances, increasing the likelihood of widespread scanning and exploitation attempts as additional technical details emerge. CTIX analysts urge any affected organizations to upgrade their NetScaler appliances immediately and follow all mitigation instructions to prevent future exploitation.