Critical Authentication Bypass and Buffer Overflow Flaws Patched in NetScaler ADC and Gateway
Cloud Software Group has released a security advisory detailing two severe vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). The issues are rated Critical, the highest severity level, prompting immediate calls for customers to apply updates.
CVE-2026-19490 allows attackers to bypass authentication by leveraging an alternate path. The flaw affects environments where the products function as SSL VPN, ICA proxy, CVPN, or RDP proxy gateways, as well as when configured as authentication, authorization, and auditing virtual servers. In certain builds, the presence of a configured SAML action is also a prerequisite for exploitation.
CVE-2026-19489 is a buffer overflow vulnerability that manifests when SIP ALG is enabled within an LSN group. Successful exploitation may result in unexpected behavior or a denial-of-service condition.
The CVSS v4.0 base scores are 9.3 for CVE-2026-19490 and 8.8 for CVE-2026-19489. The advisory contains no information indicating that the vulnerabilities have been exploited in the wild.
Patches are available in builds 14.1-73.32 and 13.1-63.21. Corresponding updates for FIPS and NDcPP editions have also been released, and administrators are strongly advised to upgrade without delay.
Related articles
Microsoft Releases Fix for Windows Defender Crashes During Quick and Full Scans
Microsoft has issued a security intelligence update to resolve a crash in Windows Defender that occurred during quick or full system scans on affected Windows 10 and Windows 11 devices. The bug, introduced after a recent set of patches, caused the antivirus service to terminate unexpectedly with the message "Threat service has stopped. Restart it" and access violation error 0xc0000005. Some users misinterpreted the repeated failures as malware infection or severe system damage, leading them to reinstall Windows entirely. Administrators were able to reproduce the issue consistently across multiple machines simply by initiating a quick scan, confirming the root cause lay in Defender itself rather than individual endpoints. The fix is included in security intelligence version 1.457.236.0 and all subsequent releases, with Microsoft advising users to ensure automatic updates are applied via Windows Update or manually through the Windows Security interface.
Critical Vulnerability in Forminator Forms WordPress Plugin Enables Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-15748 with a CVSS score of 9.8 has been identified in the Forminator Forms plugin for WordPress. The flaw allows unauthenticated attackers to upload malicious PHP files by manipulating the Select field alongside a File Upload field on published forms. This bypasses extension blocking and file type validation, potentially leading to full server compromise including web shell installation and database access. The plugin, which has more than 600,000 active installations, is affected in all versions up to and including 1.56.1. The issue was resolved in version 1.56.2 released at the end of July, with later updates including 1.57.0 now available.
CISA Adds Four Exploited Vulnerabilities to KEV Catalog Including Critical macOS Authentication Bypass
The US Cybersecurity and Infrastructure Security Agency has added four newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws affect Apple macOS, Microsoft SharePoint, and VMware vCenter among other products. One of the vulnerabilities, tracked as CVE-2026-65400, allows network-based authentication bypass in macOS Screen Sharing without valid credentials. The issue received a CVSS v3.1 base score of 9.8 and is rated Critical. Apple addressed the flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 released on August 6. Federal agencies have been instructed to apply mitigations within three days.
Apple Releases macOS Tahoe 26.6.2 Fixing 28 Vulnerabilities Including Kernel Flaws
Apple has issued macOS Tahoe 26.6.2, addressing a total of 28 security vulnerabilities tracked under CVE identifiers. The update resolves three kernel-level issues, among them a Use After Free flaw tracked as CVE-2026-65343, an out-of-bounds memory read in CVE-2026-65349, and a memory corruption problem in CVE-2026-65330. Twenty-one of the fixed vulnerabilities affect the WebKit engine, with additional patches applied to Audio, ImageIO, and IOGPUFamily components. The release incorporates fixes that were previously tested in the macOS Golden Gate 27 beta. On the following day, Apple also shipped Safari 26.6.1 for macOS Sonoma and macOS Sequoia, eliminating the same set of 21 WebKit vulnerabilities.