Citrix NetScaler ADC and Gateway: PHP remote code execution flaws (CVE-2026-109618, CVE-2026-109619) fixed in 14.1-73.49, 13.1-64.32
CVE-2026-109618 CVE-2026-109619
Published 10/11/2026 11:04 · Updated 11/11/2026 19:14 (revision 3)
Timeline
5 events over 15 d
- 27/10/2026ConfirmedCERT-FR advisories+0 min
- 27/10/2026ExploitedCERT-FR advisories+14 d
- 10/11/2026 11:04Published on WatchtowerPro CISO+0 min
- 10/11/2026 11:05UpdatedKevin Beaumont reports that Citrix is moving NetScaler to monthly Patch Thursday security…+1 d 8 h
- 11/11/2026 19:14UpdatedSiemens ProductCERT published advisories on the PHP2Shell flaws (CVE-2026-109618…
In short
Two PHP flaws in Citrix NetScaler ADC and Gateway allow an attacker to run code remotely. CISA lists both as exploited in attacks. Citrix has released fixed builds, so update as soon as possible. Shodan estimates 1.7 million internet-facing systems tagged with CVE-2026-109619 worldwide, 348,342 of them in the EU (11/11/2026). GreyNoise reports a public exploit for CVE-2026-109618; listed by CISA as known exploited (11/11/2026).
How bad is it
Critical. An attacker who can reach a vulnerable NetScaler could run their own code on it, and attacks are reported; the notes do not state what access is required.
Being exploited - on CISA's known-exploited list since 26/10/2026.
Severity score
The worst of 2 CVEs · CVSS 4.0 from NVD, from php.net, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- NetScaler ADC and Gateway 14.1 before 14.1-73.49
- NetScaler ADC and Gateway 13.1 before 13.1-64.32
- NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.286
What to do now
- Update NetScaler ADC and Gateway to 14.1-73.49 or later, 13.1-64.32 or later, 14.1-73.49 FIPS or later (14.1-FIPS), or 13.1-37.286 or later (13.1-FIPS and 13.1-NDcPP). Citrix urges doing this as soon as possible.
- Citrix-managed cloud services are already fixed, so customers there need to do nothing.
- Citrix points to its blog for immediate mitigation guidance; check it for exact settings. Interim measures only reduce exposure and do not make an appliance safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer, all 4 sources with their dates and every revision. And technology matching: which of your systems run Citrix NetScaler (ADC / Gateway), at which version, fixed or not - and what each one needs.
Main sources
Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (27 octobre 2026) CERT · Citrix Security Advisory for CVE-2026-109618 and CVE-2026-109619 Research · Citrix Security Advisory for CVE-2026-109618 and CVE-2026-109619 Research
Data: Shodan - vuln:CVE-2026-109619 (estimate, 11/11/2026) · GreyNoise - CVE-2026-109618 (estimate, 11/11/2026)