CVE-2026-109618 / CVE-2026-109619, NetScaler ADC and Gateway: the PHP2Shell flaws reach the management GUI on the NSIP, management-enabled SNIPs and the cluster IP of every supported version, with fixes planned for 2026-10-27

NetScaler Product Security says NetScaler is affected by the two PHP memory-safety flaws CVE-2026-109618 and CVE-2026-109619 because the NetScaler Management Portal uses PHP, that Citrix is working to upgrade the PHP package, and that all supported software versions are affected (NetScaler Product Security, 2026-10-22). Citrix describes both as critical flaws in PHP that could let an unauthenticated attacker execute code in the context of the affected PHP process, each rated 9.2 under CVSS 4.0: CVE-2026-109618 is memory corruption when PHP handles an out-of-memory condition during request processing, and CVE-2026-109619 is stale request state that persists after memory is released and is reused by a later request (NetScaler Product Security, 2026-10-22). The affected surfaces are the NSIP GUI, any SNIP configured to permit management access and the cluster IP GUI in a cluster; NetScaler Console (service and on premises) and NetScaler SVM are not affected (NetScaler Product Security, 2026-10-22).

Citrix plans to release fixes for all supported versions on 2026-10-27 and, until then, tells customers to restrict GUI and API access on those addresses to trusted administrative hosts or narrowly scoped management networks, to keep management interfaces off the internet behind jump hosts or tight ACLs, and to review every address that permits GUI or API management and verify that it is not broadly reachable (NetScaler Product Security, 2026-10-22). Its WAF signature v186 covers backend applications that run PHP, while signatures that protect the NetScaler management interfaces themselves were still in development (NetScaler Product Security, 2026-10-22).