Citrix hat folgenden Artikel zu diesen PHP Schwachstellen veröffentlicht:
Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619
Gemäss Citrix sind nur die IP Adressen angreifbar, hinter denen die NetScaler Management Oberfläche erreichbar ist. Das betrifft immer die NSIP und in Fällen, in denen für die SNIP das Management aktiviert ist, auch diese SNIP’s.
Kunden sollten daher ihre Installation dahingehend überprüfen, dass die gefährdeten IP Adressen nur aus sicheren Netzen erreichbar sind.
Sollte eine NSIP, oder SNIP exponiert sein, empfiehlt Citrix als Mitigation ACL’s:
Recommended immediate mitigation
Restrict GUI & API access on the NSIP, management-enabled SNIPs and the Cluster IP to trusted administrative hosts or narrowly scoped management networks. Wherever possible, keep management interfaces on isolated networks that are not Internet-facing and use jump hosts or tightly scoped ACLs to limit administrative access.
Example: allow NSIP GUI access only from a trusted host or network
The following example permits HTTP and HTTPS management access to the NSIP from a trusted administrative source, then denies all other sources:
add ns acl allow-adm-80 ALLOW -srcIP = <Console_IP/Trusted_IP> -destIP = <NSIP> -destPort = 80 -protocol TCP -priority 1
add ns acl allow-adm-443 ALLOW -srcIP = <Console_IP/Trusted_IP> -destIP = <NSIP> -destPort = 443 -protocol TCP -priority 2
add ns acl deny-rest-all-80 DENY -destIP = <NSIP> -destPort = 80 -protocol TCP -priority 3
add ns acl deny-rest-all-443 DENY -destIP = <NSIP> -destPort = 443 -protocol TCP -priority 4
apply ns acls
Replace the placeholders with the appropriate addresses for your environment. To permit a subnet or a trusted host on NetScaler using the CLI, you must add an ALLOW rule using an IP address range for subnets:
add ns acl <ACL_Name> ALLOW -srcIP <Start_IP>-<End_IP> -priority <Number>
Important implementation considerations
- Preserve NetScaler Console access so that licensing and centralized management continue to work.
- Validate the ACLs and confirm that authorized administrators retain access before ending the session.
- Account for required management, monitoring, automation, DNS, authentication, and health-monitor traffic before applying DENY rules.
- Use caution when restricting a SNIP or VIP because it can also carry application traffic. Scope ACLs specifically to management protocols and ports to avoid service disruption.
- Apply equivalent restrictions to every management-enabled IP, including the Cluster IP in cluster deployments.
- Maintain an approved recovery path, such as console access, in case an ACL unintentionally blocks administration.
- For detailed guidance, see How to Restrict NetScaler Management Interfaces with ACLs (CTX228148).