Advisory [CVE-2026-109618 +1] Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619
This security NetScaler (Citrix) advisory covers CVE-2026-109618 and CVE-2026-109619.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 2 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.
VulniPulse record published Record updated
Android app · Google Play
Monitor future NetScaler (Citrix) CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Immediate mitigation guidance for NetScaler customers By NetScaler Product Security NetScaler is impacted by two PHP memory safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because the NetScaler Management Portal uses PHP. Citrix is actively working to upgrade the PHP software package to a fixed version.
We will update this post when the fix becomes available. As recommended in NetScaler’s Secure Deployment Guide, management interfaces must be logically or physically isolated from data traffic, completely blocked from the Internet, and restricted via ACLs to trusted administrative subnets only.
Customers should immediately restrict access to NetScaler management interfaces to trusted, limited networks. This step reduces exposure by ensuring that only authorized administrative systems and users can access the management GUI and APIs.
About the vulnerabilities CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP that could allow an unauthenticated attacker to execute code in the context of the affected PHP process. Both vulnerabilities are rated 9.2 under CVSS v4.0.
CVE-2026-109618 involves memory corruption when PHP handles an out-of-memory condition during request processing. CVE-2026-109619 involves stale request state that can persist after memory is released and can then be reused by a subsequent request.
What is affected?
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Citrix is actively working to upgrade the PHP software package to a fixed version.
- We will update this post when the fix becomes available.
- Wherever possible, keep management interfaces on isolated networks that are not Internet-facing and use jump hosts or tightly scoped ACLs to limit administrative access.
- Apply equivalent restrictions to every management-enabled IP, including the Cluster IP in cluster deployments.
- Customers should immediately restrict access to NetScaler management interfaces to trusted, limited networks.
- Recommended immediate mitigation Restrict GUI & API access on the NSIP, management-enabled SNIPs and the Cluster IP to trusted administrative hosts or narrowly scoped management networks.
- For detailed guidance, see How to Restrict NetScaler Management Interfaces with ACLs (CTX228148).
Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.