CERT-FR warns of multiple Citrix NetScaler ADC and Gateway RCE vulnerabilities, including PHP flaws CVE-2026-109618 and CVE-2026-109619
CERT-FR published advisory CERTFR-2026-AVI-1394 on 27 October 2026 on multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. According to the advisory, the flaws allow an attacker to achieve remote arbitrary code execution. The advisory is based on Citrix security bulletin CTX697263 of 26 October 2026, which covers CVE-2026-109618 and CVE-2026-109619. The advisory does not report active exploitation and gives no CVSS scores or IOCs.
Entenda a falha
A vulnerabilidade
CVE-2026-109618 and CVE-2026-109619 affect Citrix NetScaler ADC and NetScaler Gateway. A Citrix blog calls them PHP vulnerabilities, and CERT-FR says they allow remote arbitrary code execution. The sources give no per-CVE breakdown, no CVSS score, and nothing on authentication or network requirements. The Citrix blog title points to the management access, but that is not confirmed as the attack path. Affected: ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286, ADC and Gateway 13.1.x before 13.1-64.32, ADC 14.1-FIPS before 14.1-73.49 FIPS, and ADC and Gateway 14.1.x before 14.1-73.49. Upgrading to those builds or later is the remediation; details are in bulletin CTX697263.
Como funciona
The articles do not describe how the vulnerable process works. They do not say which input reaches which PHP component, what the software does with it, or at which step it fails. All that is stated is that the outcome is remote arbitrary code execution and that a Citrix blog frames the CVEs around protecting NetScaler management access. Any further detail on the mechanism would be a guess, so none is given.
Por que é vulnerável
The root cause is not given in the available sources. They only classify the flaws as PHP vulnerabilities leading to remote code execution, without naming a missing check, a parsing error or any other weakness. They also do not say why the flaws went unnoticed or what the fix changes in the code. Details may be in Citrix bulletin CTX697263, which the articles reference but do not reproduce.
Como foi descoberta
The articles do not say who found the flaws or how. Citrix published security bulletin CTX697263 on 26 October 2026 covering both CVEs, and CERT-FR issued advisory CERTFR-2026-AVI-1394 on 27 October 2026 based on it. The advisory does not report active exploitation, and it gives no IOCs.
Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 14:30.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- CVEs referenced: CVE-2026-109618 and CVE-2026-109619. A Citrix blog on protecting NetScaler management access describes them as PHP vulnerabilities.
- Impact listed: remote arbitrary code execution.
- Affected versions:
- NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286
- NetScaler ADC 13.1.x before 13.1-64.32
- NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS
- NetScaler ADC 14.1.x before 14.1-73.49
- NetScaler Gateway 13.1.x before 13.1-64.32
- NetScaler Gateway 14.1.x before 14.1-73.49
- The advisory gives no per-CVE mapping of attack vectors, authentication requirements or severity.
Remediação
- Refer to Citrix bulletin CTX697263 to obtain the fixed builds and upgrade to the versions listed above.
- Consult the Citrix techzone blog on protecting NetScaler management access from CVE-2026-109618 and CVE-2026-109619 for protective guidance.
Linha do tempo
-
CERT-FR warns of multiple Citrix NetScaler ADC and Gateway RCE vulnerabilities, including PHP flaws CVE-2026-109618 and CVE-2026-109619
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1394 on 27 October 2026 on multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. According to the advisory, the flaws allow an attacker to achieve remote arbitrary code execution. The advisory is based on Citrix security bulletin CTX697263 of 26 October 2026, which covers CVE-2026-109618 and CVE-2026-109619. The advisory does not report active exploitation and gives no CVSS scores or IOCs.
Technical Details
- CVEs referenced: CVE-2026-109618 and CVE-2026-109619. A Citrix blog on protecting NetScaler management access describes them as PHP vulnerabilities.
- Impact listed: remote arbitrary code execution.
- Affected versions:
- NetScaler ADC 13.1-FIPS before 13.1-NDcPP 13.1.37.286
- NetScaler ADC 13.1.x before 13.1-64.32
- NetScaler ADC 14.1-FIPS before 14.1-73.49 FIPS
- NetScaler ADC 14.1.x before 14.1-73.49
- NetScaler Gateway 13.1.x before 13.1-64.32
- NetScaler Gateway 14.1.x before 14.1-73.49
- The advisory gives no per-CVE mapping of attack vectors, authentication requirements or severity.
Remediation
- Refer to Citrix bulletin CTX697263 to obtain the fixed builds and upgrade to the versions listed above.
- Consult the Citrix techzone blog on protecting NetScaler management access from CVE-2026-109618 and CVE-2026-109619 for protective guidance.