NetScaler ADC and Gateway: new builds for the PHP2Shell flaws

On 27 October 2026 CERT-FR (ANSSI) published advisory CERTFR-2026-AVI-1394 on multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. The stated risk is remote arbitrary code execution. The advisory refers to Citrix bulletin CTX697263 of 26 October, which covers CVE-2026-109618 and CVE-2026-109619.

These are the same identifiers as the two critical PHP vulnerabilities known as PHP2Shell, which we covered on 20 October and 23 October. Among the documents cited by CERT-FR there is also a Citrix guide titled “Protecting NetScaler management access from PHP CVE-2026-109618, CVE-2026-109619”: the bulletin therefore brings the fixes for the two PHP flaws to NetScaler and, judging by the guide’s title, the issue concerns management access to the appliances.

For NetScaler this is the fourth bulletin in a month, after the zero-days CVE-2026-88771 and CVE-2026-88772, the WHIPSHOT and SLAPSHOT malware used in the attacks and CVE-2026-107406 in SAML. Below is what is new: the CVEs, the affected versions and the builds to install.

What the advisory says

• Reference: CERTFR-2026-AVI-1394, first version dated 27 October 2026.
• Source of the advisory: Citrix security bulletin CTX697263 of 26 October 2026.
• CVEs: CVE-2026-109618 and CVE-2026-109619.
• Risk: remote arbitrary code execution.
• Solution: the fixes listed in the Citrix bulletin.

The advisory is brief: it gives no CVSS scores, no exploitation conditions and no indication of which NetScaler component is involved, and it does not mention any ongoing exploitation against NetScaler. This article is based solely on the CERT-FR advisory: for technical details, the Citrix bulletin is authoritative.

As we reported in our PHP articles, the two flaws have a CVSS 4.0 score of 9.2, were fixed by the PHP project on 21 October and, after disclosure, were the target of numerous exploitation attempts against PHP servers. If exploited on NetScaler, they would map to MITRE ATT&CK T1190 (Exploit Public-Facing Application).

Affected versions

According to CERT-FR, the following are vulnerable:

• NetScaler ADC 14.1.x before 14.1-73.49;
• NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS;
• NetScaler ADC 13.1.x before 13.1-64.32;
• NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286;
• NetScaler Gateway 14.1.x before 14.1-73.49;
• NetScaler Gateway 13.1.x before 13.1-64.32.

For the 13.1-FIPS branch the version is given this way in the advisory: check the exact build number in bulletin CTX697263.

A warning for those who updated recently. The builds listed on 8 October for CVE-2026-107406 (14.1-73.46, 13.1-64.29 and 14.1-73.46 FIPS) are older than those in the advisory: they therefore fall within the affected versions and must be updated again.

Impact for European and Italian companies

NetScaler ADC and NetScaler Gateway sit on the perimeter and often handle remote access for employees and suppliers. Remote code execution on these appliances would give an attacker a privileged position towards the internal network, as the September intrusions showed.

Four bulletins in a month for the same appliances put update processes to the test. For NIS2 entities, vulnerability management must be documented, with explicit priorities and timelines: you need to be able to show that every NetScaler, including FIPS and NDcPP instances, has reached the 26 October builds. In healthcare the gateway often opens remote access to clinical systems and should be treated with the same urgency. Any significant incident must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.

What to do now

1. Take inventory: list all NetScaler ADC and Gateway appliances, including FIPS and NDcPP instances, with the installed build.
2. Update: bring appliances at least to 14.1-73.49, 13.1-64.32 or 14.1-73.49 FIPS; for 13.1-FIPS and 13.1-NDcPP, to the build listed in bulletin CTX697263. This also applies if you updated in early October.
3. Read the Citrix guide on protecting management access from CVE-2026-109618 and CVE-2026-109619 and apply it, especially if you cannot update right away.
4. Restrict management access: as a general rule, the administration interfaces of network appliances should only be reachable from administrative networks and workstations, never from the Internet.
5. Follow only Citrix’s guidance: the PHP configuration mitigations described in our articles apply to PHP servers, not to NetScaler appliances.
6. Don’t forget the September zero-days: if an appliance was on a build older than 14.1-73.37 or 13.1-64.23, look for signs of compromise as described in the article on WHIPSHOT and SLAPSHOT, before or alongside the update.
7. Monitor: anomalous access to management interfaces, unexpected reboots and unusual outbound connections from the appliances should be investigated.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you quickly find the NetScaler appliances to update and the management interfaces reachable from outside. ARX Sentry collects firewall and network device logs in a central collector, so anomalous access and suspicious connections from the perimeter stay in front of the analysts. With ARX Horizon you can look up vulnerabilities and indicators of compromise from the portal.

Last updated: 27 October 2026