On November 12, Citrix disclosed 28 vulnerabilities affecting NetScaler ADC and Gateway, 9 of which are critical (CVSS 4.0 scores ranging from 6.9 to 9.5). There are no known exploits at this time, nor is there a workaround. netscaler-quickcheck v18.12 checks the bulletin and was run in the lab both before and after the upgrade to 14.1-73.58.

NetScaler gateways are not limited to German-speaking regions, and reports are often shared with teams that do not read German. Since v18.0, all text has therefore been included in a message catalog alongside the script, in both German and English. German remains the default, --lang en or LANG_QC=en switches in the configuration. Each additional language is a separate file containing the same keys.

From v17.29 to v17.43

On October 23, PHP2Shell was added with v17.30 (CTX697263, CVE-2026-109618, and CVE-2026-109619 in the Management Portal), one day after the Citrix blog post “Protecting NetScaler Management Access” and two days after the analyses by Unit 42 and Zscaler.

Citrix did not release the fix builds until the evening of October 27, along with the patches. Prior to that, our rule sets used the fix builds from the SAML bulletin for PHP2Shell; as a result, appliances running versions 14.1-73.41 through 73.46 were considered patched.

Only 14.1-73.49 (13.1-64.32, FIPS 73.49 or 37.286) has been fixed; until the update is released, the mitigation via DENY-ACL will help.

If you ran a test using a rule set from before October 28, 2026, please run it again.

We now only adopt fix builds from the CTX article. If there isn't one yet, the verdict reports "pending" and lists the mitigation instead of a target build.

Citrix released its next security bulletin on October 22: CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities in the Management Portal, with a CVSS 4.0 score of 9.2. All systems accessible via the management interface are affected: NSIP, SNIPs with management access, and the cluster IP. One day after the initial release, netscaler-quickcheck also checks for this.