Critical PHP2Shell flaws threaten NetScaler. Vendor recommends securing administrative access immediately
NetScaler confirmed its appliances are affected by two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The flaws may enable unauthenticated remote code execution. Patches are scheduled for 27 October 2026.
Source: NetScaler Product Security
NetScaler confirmed that its appliances are affected by two critical PHP security vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The flaws may allow unauthenticated remote code execution. The vendor plans to release patches on 27 October 2026.
Which systems are at risk?
The issue affects NetScaler administrative interfaces that use PHP. Both vulnerabilities scored 9.2/10 on the CVSS 4.0 scale.
All supported NetScaler software versions are affected, in particular:
- NSIP GUI — the primary appliance management interface.
- SNIP — network addresses with administrative access enabled.
- Cluster IP GUI — the cluster management interface.
According to the vendor, NetScaler Console (cloud and on-premises) and NetScaler SVM are not affected.
How to secure the environment?
Until updates are available, the vendor recommends:
- Immediately block Internet access to management interfaces.
- Restrict GUI and API access to trusted IP addresses and dedicated management networks only.
- Apply appropriate ACL rules on NSIP, SNIP and Cluster IP interfaces.
- Use dedicated management networks or jump hosts.
- Review the configuration of every IP address that allows device administration.
Note: When deploying ACLs, preserve access for NetScaler Console, monitoring and essential administrative services. Incorrect rules may lock you out of the appliance or disrupt application traffic.
When will patches arrive?
NetScaler announced security updates for all supported versions on 27 October 2026.
The vendor also released WAF signatures version 186 to protect PHP-based backend applications. Separate signatures for protecting NetScaler administrative interfaces are still being prepared.
Alterkom recommendation
We recommend that NetScaler administrators urgently review management-interface exposure, restrict network access and prepare an update deployment plan.
Restricting administrative access should be done immediately — do not wait for vendor patches.
Planning secure AI agents in your organisation?
Talk to Alterkom about local LLMs, access control and infrastructure for enterprise AI agents.
