netscaler-quickcheck v17.30: CTX697263 is included

Citrix released its next security bulletin on October 22: CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities in the Management Portal, with a CVSS 4.0 score of 9.2. All systems accessible via the management interface are affected: NSIP, SNIPs with management access, and the cluster IP. One day after the initial release, netscaler-quickcheck also checks for this.

New in v17.30, as of October 23, 2026

  • Builds against the bulletin; the corrected versions are 14.1-73.41, 13.1-64.28, and the FIPS versions
  • Which addresses Management Access has, and whether the access restrictions recommended by Citrix are set for ports 80/443
  • PHP memory and fatal errors in the web server log, including for admin_ui: Yellow for a vulnerable build; Red if a new PHP file appeared during the same time period

Note: No exploit signature has yet been published for these vulnerabilities. The log check is a heuristic based on error classes; it is not definitive proof. All existing checks remain unchanged.

Thanks to Dominik Soika for his help in creating this.

Who has access to your admin interface?

BACK