We use cookies to improve your experience on our site and enable certain core website functionalities. For more information, visit our Privacy Policy page.

Accept
  • Insights

Citrix Security Advisory for CVE-2026-109618 and CVE 2026-109619

Gedeon Richemond

2 min read

All Insights

Citrix Security Advisory for CVE-2026-109618 and CVE 2026-109619

Opt-in for expert insights & industry event invites  

Summary

The Cloud Software Group is aware of the following vulnerabilities affecting PHP

  • RCE via OOM corruption, CVE-2026-109618
  • RCE via stale global state, CVE-2026-109619

NetScaler is impacted by two PHP memory safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because the NetScaler Management Portal uses PHP. Citrix is actively working to upgrade the PHP software package to a fixed version. 

Customers should immediately restrict access to NetScaler management interfaces to trusted, limited networks. This step reduces exposure by ensuring that only authorized administrative systems and users can access the management GUI and APIs.  Citrix plans to release fixes to address these two PHP memory safety vulnerabilities for all supported NetScaler software versions 

About the Vulnerabilities

CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP that could allow an unauthenticated attacker to execute code in the context of the affected PHP process. Both vulnerabilities are rated 9.2 under CVSS v4.0. 

  • CVE-2026-109618 involves memory corruption when PHP handles an out-of-memory condition during request processing. 
  • CVE-2026-109619 involves stale request state that can persist after memory is released and can then be reused by a subsequent request. 
What is Affected?

The following NetScaler management interfaces use the PHP-based management access and are affected: 

  • NSIP GUI — the NetScaler IP management interface. 
  • SNIP with management access enabled — any Subnet IP configured
  • to permit management access. 
  • Cluster IP GUI — when NetScaler is deployed as a cluster. 

Customers should review every  IP address that permits GUI or API-based management and verify that it is not broadly reachable. 

All supported NetScaler software versions are impacted. NetScaler Console (Service and on premises) and NetScaler SVM are not impacted by this vulnerability. 

Restrict GUI & API access on the NSIP, management-enabled SNIPs and the Cluster IP to trusted administrative hosts or narrowly scoped management networks. Wherever possible, keep management interfaces on isolated networks that are not Internet-facing and use jump hosts or tightly scoped ACLs to limit administrative access.

Important Implementation Considerations
  • Preserve NetScaler Console access so that licensing and centralized management continue to work. 
  • Validate the ACLs and confirm that authorized administrators retain access before ending the session. 
  • Account for required management, monitoring, automation, DNS, authentication, and health-monitor traffic before applying DENY rules. 
  • Use caution when restricting a SNIP or VIP because it can also carry application traffic. Scope ACLs specifically to management protocols and ports to avoid service disruption. 
  • Apply equivalent restrictions to every management-enabled IP, including the Cluster IP in cluster deployments. 
  • Maintain an approved recovery path, such as console access, in case an ACL unintentionally blocks administration. 
More Information

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697263&articleTitle=Citrix_Security_Advisory_for_CVE_2026_109618_and_CVE_2026_109619&

https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640