NetScaler's Run of CVEs: What's Happened and What to Do Now

If you run NetScaler ADC or Gateway, 2026 has been exhausting. Six NetScaler vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities list so far this year, two of them exploited before Citrix had a fix. The most recent was added on 4 October, and on 27 October Citrix released another critical fix, this time for flaws in the PHP component that runs the management interface.

This isn’t new. NetScaler has a long history of flaws attackers move on quickly: CVE-2019-19781 in 2019, CVE-2022-27518 in 2022, CVE-2023-3519 and CitrixBleed (CVE-2023-4966) in 2023, and CitrixBleed 2 (CVE-2025-5777), CVE-2025-6543 and CVE-2025-7775 in 2025. But the pace has picked up.

2026 so far

FIPS and NDcPP builds have their own fixed versions; check the Citrix bulletin for each.

Latest: PHP fixes on 27 October

On 27 October 2026, Citrix released fixed builds for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (bulletin CTX697263, first published 22 October). They’re flaws in PHP itself, sometimes called “php2shell”:

• CVE-2026-109618: remote code execution through memory corruption when PHP runs out of memory
• CVE-2026-109619: remote code execution through stale state left over from an earlier request

Both are rated critical (CVSS 9.2) and allow unauthenticated remote code execution. CISA added both to its exploited list on 26 October, based on attacks against PHP in general.

What it means for NetScaler: on NetScaler, PHP runs behind the management GUI. That makes the NSIP, any SNIP with management access enabled and the cluster IP the exposed surfaces; Gateway and AAA virtual servers aren’t the way in. Citrix-managed cloud services have already been fixed, and NetScaler Console isn’t affected.

These builds also include the earlier 2026 fixes, including the 8 October fix for CVE-2026-107406 (a SAML flaw with no reported exploitation), so they’re the builds to aim for. Until you can upgrade, restrict GUI and API access to trusted admin hosts with ACLs. Don’t use the PHP version to check whether you’re fixed; go by the NetScaler build number.

The pattern

• The gateway is the target. Almost every one of these needs a Gateway or AAA virtual server, which is exactly what’s on the internet.
• SAML keeps coming up. Four of the six involve SAML. If you don’t use it on a NetScaler, don’t configure it.
• Patching isn’t the end. Mandiant’s write-up of the September zero-days describes web shells, a root backdoor, a tunnelling tool into the internal network and credential theft. A patched appliance can still be compromised.
• The management interface is a target too. The October PHP flaws reach the management GUI, not the gateway. A management interface on the internet turns an admin-side bug into an internet-facing one.
• Old branches fall behind. The 13.1 branch reached End of Maintenance on 15 September 2026. Plan your move to 14.1 now.
• Citrix-managed services are patched for you. The bulletins only apply to customer-managed NetScalers. The Citrix Gateway service used with DaaS is patched by Citrix.

What to do now

1. Get to the latest build. At the time of writing that’s 14.1-73.49 or 13.1-64.32 or later, which covers everything in this post, including the October PHP fixes. If you’re on an older branch, move to 14.1.
2. If an appliance was exposed and unpatched, assume compromise. Preserve evidence first (a VM snapshot with memory, logs and a support bundle), then run Citrix’s IOC scanner and hunt using the published indicators.
3. Kill existing sessions after upgrading. Stolen session tokens survive a patch. See the commands below.
4. Rotate credentials. Admin accounts, LDAP bind accounts, RADIUS secrets, certificates and keys, and passwords for users who signed in through a compromised appliance.
5. Shrink the attack surface. Keep management interfaces (NSIP, SSH, the GUI and NITRO API) off the internet. Turn off SAML, DTLS and other features you don’t use.
6. Send the logs somewhere. NetScaler doesn’t forward the useful logs by default. Send ns.log, /var/log/messages and HTTP logs to your SIEM, and alert on NSPPE crashes and new core files.
7. Consider whether you still need it. For HDX-only access with Citrix DaaS, the Gateway service moves the patching to Citrix.

What Citrix recommends

If you’re running an affected version of NetScaler ADC or NetScaler Gateway, Citrix strongly urges you to install the updated versions as soon as possible. Citrix also strongly recommends that you subscribe to alerts, so you’re told whenever a NetScaler security bulletin is created or changed.

To reduce risk and be better prepared, organisations should:

• Stay on a supported NetScaler release and apply security updates promptly.
• Review deployments against the NetScaler Secure Deployment Guide and current security advisories.
• Make sure management interfaces aren’t exposed to the internet and that administrative access is tightly controlled.
• Keep a tested process for assessing exposure, reviewing indicators of compromise and recovering services if needed.

Resources

• NetScaler Secure Deployment Guide
• Indicators of compromise detection in NetScaler Console
• Subscribe to Citrix security bulletin alerts

From the field: which build is each NetScaler on?

This PowerShell 7 script asks each appliance for its version through the NITRO API and flags anything below the latest fixed build. Use a read-only NetScaler account.

$appliances = 'ns01.contoso.local', 'ns02.contoso.local'
$cred       = Get-Credential   # read-only NetScaler account
$minimum    = @{ '14.1' = [version]'73.49'; '13.1' = [version]'64.32' }

foreach ($ns in $appliances) {
    $headers = @{
        'X-NITRO-USER' = $cred.UserName
        'X-NITRO-PASS' = $cred.GetNetworkCredential().Password
    }
    $v = (Invoke-RestMethod "https://$ns/nitro/v1/config/nsversion" -Headers $headers -SkipCertificateCheck).nsversion.version

    if ($v -match 'NS(\d+\.\d+): Build (\d+\.\d+)') {
        $branch = $Matches[1]; $build = [version]$Matches[2]
        [pscustomobject]@{
            Appliance = $ns
            Branch    = $branch
            Build     = $build
            Status    = if (-not $minimum[$branch]) { 'Unsupported branch: upgrade to 14.1' }
                        elseif ($build -lt $minimum[$branch]) { 'Needs patching' }
                        else { 'OK' }
        }
    }
}

-SkipCertificateCheck is only there for appliances with self-signed management certificates; remove it if yours are trusted. FIPS builds use different numbers, so check those against the bulletin by hand.

After upgrading, end every existing session from the NetScaler CLI, so stolen session tokens stop working:

kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
kill aaa session -all
clear lb persistentSessions

Quick hunting checks from the appliance shell, taken from Mandiant’s September write-up:

# Unexpected PHP handlers or aliases in httpd.conf
grep -En -i "application/x-httpd-php|php_flag|AliasMatch" /etc/httpd.conf

# The shell should be -rwxr-xr-x, not -rwsr-xr-x
ls -l /bin/sh

Anything unexpected means treating the appliance as compromised: isolate it, preserve evidence and rebuild.

Bottom line

NetScaler is a high-value target because it sits on the internet, in front of everything, and holds sessions and credentials. Patch fast, kill sessions, hunt rather than assume, and switch off what you don’t use. And if a Citrix-managed gateway would do the job, let Citrix carry the patching.

Sources

• Citrix security advisory for CVE-2026-109618 and CVE-2026-109619 (Citrix, CTX697263)
• CVE-2026-109618 and CVE-2026-109619: critical RCE in PHP (Rapid7)
• NetScaler CVEs and php2shell: what you should know (Poppelgaard)
• Security bulletin for CVE-2026-88771 to CVE-2026-88778 (Citrix)
• Security bulletin for CVE-2026-3055 and CVE-2026-4368 (Citrix)
• Defending against active exploitation of NetScaler (Google Threat Intelligence)
• Exploitation of vulnerabilities affecting NetScaler (UK NCSC)
• CISA flags new exploited NetScaler flaw, CVE-2026-88779 (Help Net Security)
• CVE-2026-8452 research note (Cloud Security Alliance)
• Critical NetScaler vulnerability exploited, CVE-2026-19490 (SecurityWeek)
• Two unpatched NetScaler zero-days under active exploitation (The Hacker News)