Citrix patches critical PHP flaws in NetScaler ADC and Gateway
On 27 October 2026 Citrix released security updates for NetScaler ADC and NetScaler Gateway. The fixes address two serious PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can lead to remote code execution (RCE).
Source: Citrix — CTX697263
On 27 October 2026 Citrix released security updates for NetScaler ADC and NetScaler Gateway. The fixes address two serious PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can lead to remote code execution (RCE).
Security fixes now available
The vendor urges administrators to update appliances running affected software versions as soon as possible.
Security bulletin CTX697263 lists the following fixed releases:
Product | Fixed release |
|---|---|
NetScaler ADC / Gateway 14.1 | 14.1-73.49 and later |
NetScaler ADC / Gateway 13.1 | 13.1-64.32 and later releases of 13.1 |
NetScaler ADC 14.1-FIPS | 14.1-73.49 FIPS and later |
NetScaler ADC 13.1-FIPS / NDcPP | 13.1.37.286 and later |
What should administrators do?
Administrators should check the current NetScaler version, review exposure of management interfaces and schedule installation of the appropriate fix.
Restricting access to the management console does not replace the security update.
Alterkom recommends an urgent review of Citrix NetScaler environments and an update of affected installations in line with the vendor guidance.
Source
Official Citrix bulletin CTX697263: CTX697263.
Further technical guidance: protecting NetScaler management access.
Planning secure AI agents in your organisation?
Talk to Alterkom about local LLMs, access control and infrastructure for enterprise AI agents.
