CitrixAnalysisCitrix resolves critical NetScaler ADC and Gateway PHP2Shell management RCE flaws
What happened.Cloud Software Group released security advisory CTX697263 addressing critical remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway.
Why it matters.Application delivery controllers direct internet traffic across corporate microservices and internal applications. When management interfaces suffer unauthenticated code execution, adversaries establish persistent footholds on edge appliances. Infrastructure teams managing NetScaler must apply firmware version 14.1-73.49 or 13.1-64.32. System administrators should isolate management interfaces behind strict internal subnets.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws stem from improper memory management during out-of-memory error recovery in PHP.
- Attack vector: Unauthenticated remote actors can submit crafted HTTP requests to the HTTPS management interface and XML API to achieve arbitrary code execution.
- Affected appliances: The defects impact customer-managed on-premises NetScaler ADC and NetScaler Gateway deployments on release tracks 13.1 and 14.1.
- Cloud boundary: Cloud-hosted NetScaler services managed by Citrix are unaffected, with exposure limited to customer-managed hardware and virtual appliances.
- Remediation releases: Citrix released NetScaler versions 14.1-73.49 and 13.1-64.32 alongside updated FIPS firmware builds, advising immediate installation.