Citrix fixes PHP2Shell in NetScaler: upgrade to 14.1-73.49 or 13.1-64.32

• Affected: all supported NetScaler ADC and Gateway builds before the fixed releases below. The exposed surface is the PHP-based management GUI and API.
• Fixed in: 14.1-73.49, 13.1-64.32, 14.1-73.49 FIPS, and 13.1-37.286 FIPS/NDcPP.
• Exploited? PHP2Shell is in CISA KEV since 26 October 2026 (checked 27 October 2026). Citrix reports no attacks on NetScaler.
• Do this now: upgrade, then limit the NSIP, management SNIPs and Cluster IP to admin hosts.

What happened

An unauthenticated attacker who can reach a NetScaler management interface could run code on the appliance through PHP2Shell. Citrix now ships fixed builds for NetScaler ADC and NetScaler Gateway.

Citrix updated advisory CTX697263 on 27 October 2026. Its changelog reads "Updated remediation versions for Citrix NetScaler ADC and Citrix NetScaler Gateway." The advisory first appeared on 22 October 2026 with no fixed build.

The two flaws are CVE-2026-109618 and CVE-2026-109619 in PHP itself. PHP fixed them on 21 October 2026, as covered in our PHP2Shell explainer. NetScaler is exposed because its management portal runs on PHP.

Who is affected

Customer-managed NetScaler ADC and NetScaler Gateway are affected. Citrix says all supported NetScaler software versions are impacted until upgraded.

Citrix prints the last build as 13.1.37.286 in the advisory. It is the same build in the usual hyphen notation.

The NetScaler blog names three affected entry points. They are the NSIP GUI, any SNIP with management access enabled, and the Cluster IP GUI in a cluster. Both GUI and API access count.

Am I affected? Check two things. Is your build below the table above? Can untrusted networks reach any IP that allows GUI or API management? If both answers are yes, treat the appliance as exposed.

Citrix lists NetScaler Console, on-premises and service, and NetScaler SVM as not impacted. CTX697263 also marks StoreFront, Virtual Apps and Desktops, XenServer and ten other products as not impacted. Citrix says its managed cloud services are already fixed.

What is confirmed

CTX697263 names only CVE-2026-109618 and CVE-2026-109619. The four fixed builds in the table match the advisory text. The NetScaler blog, last updated 27 October 2026, says 14.1 and 13.1 builds with the fix are available.

PHP scores both flaws CVSS 9.2. NVD lists both records as Analyzed. CISA added both to its Known Exploited Vulnerabilities catalog on 26 October 2026, with a federal due date of 29 October. Read our KEV story.

The new builds also clear earlier NetScaler bulletins. Each earlier bulletin says its fixed build "and later releases" are safe. The table below compares the 14.1 and 13.1 thresholds.

One caveat applies. CVE-2026-88778 in CTX697096 also needs a TCP setting, Enhanced ISN generation. A build upgrade alone does not close it.

What is not confirmed

Citrix does not report any exploitation of PHP2Shell on NetScaler. The KEV entries list PHP as the product, not NetScaler. We found no primary source that confirms an attack on a NetScaler appliance.

CTX697263 does not itself say the new builds fix CTX697096, CVE-2026-88779 or CVE-2026-107406. That conclusion comes from the build numbers in each bulletin. The older bulletins were not updated on 27 October 2026.

Citrix does not list Gateway or AAA virtual servers among the affected interfaces. It does not state that they are safe either. The advisory also names no fix for end-of-life lines such as 13.0.

Citrix says WAF signatures for the management interfaces are still in development. Signature v186 covers PHP applications behind NetScaler, not the appliance itself.

What to do

1. Upgrade every NetScaler ADC and Gateway to 14.1-73.49, 13.1-64.32, or the matching FIPS or NDcPP build.
2. Find impacted appliances with NetScaler Console. Its CVE Detection view now flags CVE-2026-109618.
3. Restrict GUI and API access on the NSIP, management SNIPs and Cluster IP to trusted admin hosts.
4. Keep management interfaces off the internet. Use an isolated network and jump hosts.
5. Apply the Enhanced ISN TCP setting if CVE-2026-88778 applies to you.
6. Replace end-of-life NetScaler builds. Citrix lists no fix for them.

Citrix's ACL guidance in CTX228148 explains how to limit management access. Test the rules and keep a console path so you do not lock yourself out.

Our take

PHP2Shell was never only a web hosting problem. Appliances bundle PHP too, and the bug fires before any login check. NetScaler is a clear case.

The good news is the narrow surface. Citrix ties the risk to management interfaces, which should never face the internet. The new 14.1 and 13.1 builds also roll up four NetScaler bulletins from the last month.

For the earlier NetScaler fixes, see the CVE-2026-88771 command execution story, the exploited SAML overflow and the CVE-2026-107406 SAML fix.