We’d like to make you aware of two critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Both carry a CVSS score of 9.2 and allow an unauthenticated attacker to remotely execute code. These flaws are confirmed as actively exploited in the wild, so we strongly recommend urgent attention.
Summary of the Vulnerabilities:
- CVE-2026-109618 (CVSS 9.2, Critical) – Remote code execution through memory corruption in PHP, triggered by out-of-memory handling.
- CVE-2026-109619 (CVSS 9.2, Critical) – Remote code execution through stale internal request state in PHP.
- Known as “PHP2Shell”, these are flaws in PHP, the language behind the NetScaler management portal. They affect the management interface only: the NSIP GUI, any SNIP with management access enabled, and the Cluster IP GUI. Gateway and AAA logon pages are not exposed.
- Important: These vulnerabilities are confirmed as exploited in the wild and have been added to CISA’s Known Exploited Vulnerabilities catalog.
Full Citrix article can be found here.
What's Affected:
- NetScaler ADC and NetScaler Gateway 14.1 (builds before 14.1-73.49)
- NetScaler ADC and NetScaler Gateway 13.1 (builds before 13.1-64.32)
- NetScaler ADC 14.1 FIPS (builds before 14.1-73.49 FIPS)
- NetScaler ADC 13.1 FIPS and NDcPP (builds before 13.1-37.286)
- NetScaler Console, NetScaler SVM and Citrix-managed cloud services are not affected. Cloud customers do not need to take any action.
Recommended Action:
We strongly encourage reviewing your environment to identify if you are running an affected version. These vulnerabilities are resolved in the following builds, and we recommend updating as soon as possible:
- 14.1-73.49 (and 14.1-73.49 FIPS) or later
- 13.1-64.32 or later
- 13.1-37.286 FIPS/NDcPP or later
These builds also include the fixes from Citrix’s recent September and October NetScaler bulletins, so a single upgrade brings you fully up to date. Please note that active ICA and VPN sessions will drop during the upgrade, so plan for a maintenance window.
Until you can patch, we recommend immediately restricting access to all NetScaler management interfaces (GUI and API) so they’re reachable only from trusted administrative networks and never from the internet.
At Kyocera, we understand the critical importance of securing your infrastructure. If you need help reviewing your environment, checking for compromise or applying the update, please contact our team. You can reach our helpdesk at help@dau.kyocera.com.
