Critical Authentication Bypass and Buffer Overflow Flaws Patched in NetScaler ADC and Gateway
Cloud Software Group has released a security advisory detailing two severe vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). The issues are rated Critical, the highest severity level, prompting immediate calls for customers to apply updates.
CVE-2026-19490 allows attackers to bypass authentication by leveraging an alternate path. The flaw affects environments where the products function as SSL VPN, ICA proxy, CVPN, or RDP proxy gateways, as well as when configured as authentication, authorization, and auditing virtual servers. In certain builds, the presence of a configured SAML action is also a prerequisite for exploitation.
CVE-2026-19489 is a buffer overflow vulnerability that manifests when SIP ALG is enabled within an LSN group. Successful exploitation may result in unexpected behavior or a denial-of-service condition.
The CVSS v4.0 base scores are 9.3 for CVE-2026-19490 and 8.8 for CVE-2026-19489. The advisory contains no information indicating that the vulnerabilities have been exploited in the wild.
Patches are available in builds 14.1-73.32 and 13.1-63.21. Corresponding updates for FIPS and NDcPP editions have also been released, and administrators are strongly advised to upgrade without delay.
Related articles
Adobe Issues Critical Security Updates for ColdFusion Fixing Nine CVEs Including Eval Injection Flaws
Adobe has released security updates for Adobe ColdFusion to address nine vulnerabilities, urging users to apply the patches immediately. The update coincides with Patch Tuesday on September 8, 2026, and covers issues such as Eval injection, SQL injection, cross-site scripting, and access control weaknesses. Six of the vulnerabilities are rated Critical, with the highest CVSS v3.1 base score reaching 9.9 for CVE-2026-48273. The remaining three vulnerabilities are classified as Important. Adobe ColdFusion users are advised to update without delay to mitigate risks of code injection and unauthorized access. The advisory also references related security issues in other products including Canva, BIG-IP, and Dell SCG.
eBPF Verifier Discrepancy Revealed: PREVAIL Accepts Safe Code Rejected by Linux Kernel Verifier
Researchers discovered that the same BPF object file receives conflicting verdicts from different verifiers. The program correlated_branch.c from the ebpf-samples repository passes verification under PREVAIL but is rejected by the Linux kernel verifier. The divergence occurs because the kernel verifier tracks scalar bounds separately from packet pointer offsets, while PREVAIL maintains explicit links between checked packet sizes and pointer states. The XDP function ConvergedBranch performs a bounds check via check_packet before accessing an Ethernet header, yet the kernel verifier fails to propagate the guarantee to the subsequent load instruction. Replacing the helper call with an inline comparison against data_end allows the kernel verifier to accept the program. The finding highlights that verifier rejection does not always indicate an actual safety violation in eBPF code.
Critical ASUS Control Center Enterprise Flaw Allows Remote Root Access via CVE-2026-75754
A critical vulnerability identified as CVE-2026-75754 in ASUS Control Center Enterprise (ACC) carries a maximum CVSS score of 10.0 and enables unauthenticated remote attackers to gain full control of the management server and all connected devices. The flaw stems from a combination of missing authentication on a critical function, a server-side request forgery (SSRF) issue, and hardcoded credentials embedded directly in the software. Attackers can craft a malicious HTTP request to extract the system’s encryption key, activate an SSH service on TCP port 2222, and use fixed credentials to obtain a root shell without any user interaction. Once inside, the attacker can read, modify, or delete data stored in the ACC platform and propagate the compromise across managed servers, PCs, and workstations. All versions of ASUS Control Center Enterprise through 4.0.0.2 are affected. ASUS released a security advisory on September 4, 2026, urging immediate updates to mitigate the risk.
Critical Zero-Day 'StyleSmuggler' Vulnerability Exploited in Adobe Commerce and Magento
A zero-day vulnerability dubbed StyleSmuggler is being actively exploited in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution and install backdoors on e-commerce servers. The flaw allows attackers to inject malicious PHP code into files generated by the platform and then force the template system to process it, with the attack chain triggered during the generation of default transaction failure emails. Exploitation has been observed since September 4 and works even if the email is not successfully sent. Researchers have reproduced the attack on clean installations of versions 2.4.7, 2.4.8, and 2.4.9, as well as on a fully patched Magento 2.4.6-p15 system. After compromise, a Rust-based implant is deployed outside the store directory, masquerading as the process [kworker/u:8:0] and maintained via a cron job that restarts it every five minutes. As of September 6, Adobe had not released a CVE, official patch, or specific workaround, though the next scheduled security update is set for September 8.