Critical Authentication Bypass and Buffer Overflow Flaws Patched in NetScaler ADC and Gateway
Cloud Software Group has released a security advisory detailing two severe vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). The issues are rated Critical, the highest severity level, prompting immediate calls for customers to apply updates.
CVE-2026-19490 allows attackers to bypass authentication by leveraging an alternate path. The flaw affects environments where the products function as SSL VPN, ICA proxy, CVPN, or RDP proxy gateways, as well as when configured as authentication, authorization, and auditing virtual servers. In certain builds, the presence of a configured SAML action is also a prerequisite for exploitation.
CVE-2026-19489 is a buffer overflow vulnerability that manifests when SIP ALG is enabled within an LSN group. Successful exploitation may result in unexpected behavior or a denial-of-service condition.
The CVSS v4.0 base scores are 9.3 for CVE-2026-19490 and 8.8 for CVE-2026-19489. The advisory contains no information indicating that the vulnerabilities have been exploited in the wild.
Patches are available in builds 14.1-73.32 and 13.1-63.21. Corresponding updates for FIPS and NDcPP editions have also been released, and administrators are strongly advised to upgrade without delay.
Related articles
Weekly Roundup: Next.js Leads Critical Vulnerability Reports as Chrome, Tomcat, and PostgreSQL See Major Patches
Security NEXT has published its list of the ten most-read articles for the week of August 23-29, 2026. The top story covered multiple serious vulnerabilities in Next.js that prompted an accelerated release schedule. Other high-interest items included a critical flaw in Zscaler Client Connector, several issues in Apache Tomcat rated critical, and Google’s Chrome 152 update fixing 327 vulnerabilities. Additional reports highlighted a ransomware incident at a systems development firm, flaws in SKYSEA Client View, 28 vulnerabilities fixed in PostgreSQL, and confirmed exploitation of six known flaws in SQL Server and NetScaler. The list also featured a vulnerability in the Android version of the Digital Agency’s My Number Point app and warnings about active exploitation of a WebLogic module flaw.
Multiple Critical Vulnerabilities in Langflow Enable Remote Code Execution
IBM disclosed three severe vulnerabilities in the open-source Langflow project on August 24, 2026. The flaws affect server instances and allow attackers to execute arbitrary code under specific conditions. CVE-2026-19286 is a code injection issue in the Agent-to-Agent (A2A) public endpoint that bypasses existing restrictions when authentication is disabled. CVE-2026-19295 permits authenticated users to evade custom component restrictions via eval injection in flow templates, leading to OS-level command execution. CVE-2026-18729 stems from insufficient input validation and lets low-privileged authenticated users bypass protected paths to run arbitrary code on the server. Patches addressing all three issues are now available.
ServiceNow Discloses Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Remote Code Execution and SQL Injection
ServiceNow has released security updates addressing four vulnerabilities in its AI platform, including three rated CVSS 10.0. The flaws enable unauthenticated attackers to achieve remote code execution, privilege escalation, and arbitrary SQL execution against core ITSM systems used by large enterprises worldwide. Affected components include the GraphQL Composite Data API, system configuration image upload processor, and dynamic schema ORDER BY handling. ServiceNow states it has patched hosted instances and provided hotfixes for self-hosted customers running Xanadu, Yokohama, Zurich, and Australia branches. This follows a July disclosure of a related sandbox escape tracked as CVE-2026-6875 that showed signs of in-the-wild exploitation. No public exploits or confirmed active attacks have been observed for the new issues yet, but the extremely low attack complexity leaves a narrow remediation window for organizations running exposed instances.
AI Agent Uncovers Unauthenticated Router Config Dump Leading to CVE Filing
An LLM agent tasked only with documenting network topology independently discovered a critical authentication bypass in a home router firmware. The agent performed read-only reconnaissance, extracted the full configuration including base64-encoded admin passwords and WPA2 keys via an unprotected CGI endpoint, and verified the finding by obtaining a valid session cookie. It then produced a complete coordinated disclosure report, classified the issue under CWE-306 with a CVSS 3.1 score of 8.8, and prepared the MITRE CVE submission package. The vulnerability affects LAN-side management interfaces of certain SOHO routers running legacy Boa web servers and remains unpatched due to inaccessible vendor firmware channels. The researcher maintained strict read-only permissions for the agent throughout the process, ensuring no configuration changes occurred. The case demonstrates how autonomous agents can accelerate vulnerability research while staying within defined operational boundaries.