Philips clears itself of the NetScaler bug CISA put on a three-day deadline

MedDevice Cyber Staff · Sep 29 · 3 min read · Via Philips product security advisories

Citrix disclosed CVE-2026-19490 and CVE-2026-19489 on August 20, two more flaws in NetScaler ADC and Gateway, the appliance many hospitals put in front of their VPN and federated login. CVE-2026-19490 is an authentication bypass using an alternative path, scored 9.3 under CVSS version 4.0, and it reaches any appliance configured as a gateway, meaning an SSL VPN, ICA Proxy, CVPN, or RDP Proxy virtual server, or as an AAA virtual server. CVE-2026-19489 is a memory overflow in the SIP ALG feature when an LSN group is configured, scored 8.8, and it can crash the appliance outright.

The exposed builds are NetScaler ADC and Gateway 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, plus the FIPS and NDcPP variants before their matching point releases. Citrix shipped the fix the same day it disclosed both bugs. CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog on September 9 and gave federal civilian agencies until September 12 to remediate it, a three day window that says more about CISA's patience with this appliance family than it does about the bug itself.

Philips published its own advisory on September 29, more than five weeks after Citrix's disclosure, and said no Philips products are known to be impacted. That is the latest in a run of NetScaler advisories Philips has issued this year, each clearing its own name against a different CVE pair. The appliance itself carries no Philips code, but it often sits in front of Philips systems anyway, carrying remote service sessions and cloud control planes back into hospital networks.

An authentication bypass using an alternative path means the gateway's login decision gets routed around rather than forced open. That is worse than a brute-force risk in one specific way: the attacker never supplies a credential that would show up in a failed login log. Rapid7 had not observed active exploitation as of August 19, but it watched how fast the two prior NetScaler bugs this year went from proof of concept to attack and recommended emergency patching rather than waiting for one.

For device manufacturers the pattern matters more than any single CVE. NetScaler, a SAML library, Next.js, an enterprise PLM platform. None of it is code a manufacturer wrote, yet all of it sits somewhere in the path between a device and the hospital network that depends on it. Philips has made a habit of saying, in public and inside weeks, whether that path held. A manufacturer that stays quiet on its own perimeter exposure leaves the customer guessing at the one moment guessing costs the most.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Patch NetScaler ADC and Gateway to 14.1-73.32 or 13.1-63.21, or the matching FIPS and NDcPP point release, the builds Citrix shipped on August 20. CVE-2026-19490 is an authentication bypass rather than a brute-force risk, so patching alone does not prove a previously exposed appliance stayed clean. There is no workaround short of the update itself.

Patch to the fixed builds. Move NetScaler ADC and Gateway to 14.1-73.32 or 13.1-63.21, or the matching FIPS and NDcPP point release, the versions Citrix shipped on August 20.
Audit gateway and AAA configurations for prior exposure. Treat any appliance that ran as a VPN virtual server, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server on an unpatched build as potentially reached before the patch landed.
Publish an exposure statement. Tell customers whether this appliance sits anywhere in your remote-access or cloud control path, the way Philips did on September 29.
Segment perimeter authentication from device networks. Keep the gateway's management and AAA planes off the segments that carry device or patient data traffic, so a bypass on one does not reach the other.

For Device ManufacturersFix the class in the product

The device is fine; the backend decides who gets in. As the maker, verify the password against a stored hash before issuing a token, put every function and object behind a server-side authorization check, and rate-limit. Assume any account reachable before the fix was reached.

Verify credentials server-side. Return a token only on a real hash match, never on a format or shape check.
Authorize every endpoint and object. No route trusts a client assertion of identity or role; scope tokens and make them short-lived.
Throttle and lock out. Add rate limiting and lockout so credentials cannot be brute-forced.

Mapped EMB3D mitigations

Questions & Answers

Is CVE-2026-19490 in Citrix NetScaler being actively exploited?

Rapid7 had not observed active exploitation of CVE-2026-19490 as of August 19, 2026, but CISA added it to its Known Exploited Vulnerabilities catalog on September 9, 2026, with a September 12 remediation deadline for federal agencies.

Are Philips products affected by Citrix NetScaler CVE-2026-19489 and CVE-2026-19490?

Philips published an advisory on September 29, 2026 covering both CVEs and said no Philips products are known to be impacted.

Which NetScaler ADC and Gateway versions fix CVE-2026-19490?

Citrix fixed CVE-2026-19490 and CVE-2026-19489 in NetScaler ADC and Gateway 14.1-73.32 and 13.1-63.21, along with matching FIPS and NDcPP builds, released August 20, 2026.

← Back to Threat Intel