Skip to main content

CVE-2026-88771 through CVE-2026-88778, CVE-2026-88779, CVE-2026-107406 and php2shell, what you should know and how to fix your NetScaler ADC, NetScaler Gateway

NetScaler

This blogpost is made to help you understand CVE-2026-88771, CVE-2026-88772 and the six other vulnerabilities in Citrix security bulletin CTX697096, and CVE-2026-88779, the SAML attack, which Citrix published in a separate bulletin, CTX697174, and CVE-2026-107406, a critical SAML flaw Citrix published on 8 October in CTX697191. Since 21 October it also covers php2shell (PHP CVE-2026-109618 / CVE-2026-109619), which reaches the NetScaler management GUI and is fixed since 27 October (CTX697263). For CTX697305 (12 November, 28 CVEs that affect every NetScaler) see my separate post: CTX697305: 28 new NetScaler vulnerabilities. It also explains how you can check if you are vulnerable, and gives community guidelines on how to fix your environment. This blogpost is not covering the details of the exploits out there, as I have no interest in sharing what the red team is doing. All responsibility is your own. I highly recommend you read the blogpost and take action immediately, don’t hesitate.

(Last updated 12th November 2026)

Continue reading

Citrix XenApp Essentials – Microsoft Azure

Citrix XenApp Essentials is now available on Microsoft Azure.

Citrix XenApp Essentials is replacing Microsoft Azure RemoteApp and customers can now benefit the technology from Citrix in a simplified portal on Azure to deliver published apps to any device from any Azure datacenter.

Citrix XenApp Essentials is the fastest and easiest way to securely deliver Windows apps from Microsoft Azure to any device. This unique application virtualization service combines industry-leading XenApp technology with the power and flexibility of Microsoft Azure to provide a simple, prescriptive, and easy-to-consume app delivery solution. Citrix and Microsoft deliver an integrated experience that simplifies onboarding for XenApp Essentials and Azure IaaS, providing a single interface to design, deploy and deliver virtualized Windows apps from Azure.

Continue reading

Google Chrome 45.x Blocks GPU Acceleration for WebGL, Direct2D, DirectWrite with Citrix XenApp on Windows 2008R2/2012/2012R2

Solution: Google Chrome 45.x Blocks GPU Acceleration for WebGL, Direct2D, DirectWrite with Citrix XenApp on Windows 2008R2/2012/2012R2

Google Chrome v. 45  have changed their behaviour of their web browser, so they are blacklisting GPUs, which means hardware acceleration is disabled by default in a Remote session this behaviour is seen in Microsoft RDS with RemoteFX, Citrix XenApp 6.5 -> 7.6 with vGPU/GPU pass-through. Behaviour is also seen on Linux environments with Google Chrome.

Issue highlightet in a Citrix XenApp 7.6 (2008R2/2012/2012R2) with GPU

Open Google Chrome and type in chrome://gpu and then you will see if your RDS/XenApp with a GPU is working or not.
With Google Chrome v 45 the default behaviour is now that Google choose to disabling the GPU.

browser - chrome xa 2012r2 cpu issue - graphics feature issue

Google Chrome experience with a GPU (Citrix XenDesktop vs Citrix XenApp)

browser - chrome xd vs xa gpu - 2008R2 vs Win7

above picture confirms the GPU is not enabled in Google Chrome with RDS/XenApp

interesting is that Multiple Raster Threads in Win7 with a GPU is disable… why lets find out.

This is properly because you haven’t configured the CPU correctly in the hypervisor for the virtual machine.
* hint I did on purpose so you can understand it can be complex to troubleshoot if you don’t configure your environment correctly.

browser - chrome win7 cpu issue fix
best practices with HDX 3D Pro is 4 vCPU and in XenServer 6.5 you configure it 2:2

Then Multiple Raster Threads works in Win7 after you changed the configuration of the CPU on the Win7 vm.

browser - chrome win7 cpu fix

browser - chrome win7 cpu issue fixed

below picture confirms the GPU is not enabled in Google Chrome with RDS/XenApp in Server 2012R2

browser - chrome xd vs xa gpu - 2012r2 vs win81

Now we have validated that the GPU is blacklisted in RDS/XA with a GPU, lets see if we can fix this.

Performance with a WebGL web app in Google Chrome

CPU is very high when the Google Chrome is running the WebGL application. This is because its using the CPU to do software rasterize of the GPU and this makes your user able to run a webgl application without a GPU, but wait. We actually have a GPU in our RDS/XA server now, why is this not offloading the CPU, thats because Google desided to turn off GPU and blacklist them.

browser - chrome xa 2012r2 cpu issue

Solution

  1. Edit Google Chrome link and after the chrome.exe add
    –ignore-gpu-blacklistgooglechrome
  2. Open Google Chrome and run chrome://gpu in the browser
  3. Check if Hardware acceleration is now working for all functions in Google Chrome

browser - chrome xa 2012r2 cpu issue - graphics feature

GPU hardware acceleration is now working in RDS/XA with a GPU in Google Chrome and CPU is now offloaded to the GPU as you can see in the below picture.

browser - chrome xa 2012r2 cpu issue fixed

 

 

 

Citrix Netscaler Gateway 11

Citrix have released Netscaler Gateway 11

This is a major release and one thing I love about this release is that the entire GUI is again changed and now there is support for VPN access with Android, IOS, Linux.

NetScaler Gateway 11.0 adds the following new features and enhancements:

Citrix NetScaler Gateway 11 with Unified Gateway

This feature extends NetScaler Gateway connectivity with access to any web application through a single URL, along with seamless single sign-on and sign-off. Single URL access can be configured for:

  • Internal organizational web applications
  • Software as a Service applications, including SAML based single sign-on when available
  • Outlook Web Access and SharePoint as clientless applications
  • Load balanced applications served through NetScaler load balancing virtual servers
  • XenApp and XenDesktop published resources.

The feature can be configured and managed with the Unified Gateway wizard in the NetScaler configuration utility. [#00552862, #0438356, #0519875, #0519875]

SmartControl

SmartControl allows policy-based management decisions for ICA connections through the VPN. SmartControl policies can be applied at the session level to control user’s ICA environment and to further manage ICA connections with SmartGroup sorting decisions.

Portal Customization and EULA

The Portal Customization options have been expanded to allow end-to-end customization of the VPN user portal. Administrators can apply themes to their VPN portal design or use themes as a foundation for their own customization or branding. An option to present VPN users an End User License Agreement (EULA) has also been added to the portal design. Portal themes and EULAs can be bound to a VPN virtual server or specified as global VPN parameters.

New and Updated Gateway Clients

NetScaler Gateway release 11.0 adds new plug-in clients for the following operating systems:

  • Android 4.1 or later
  • iOS 7 or later
  • Linux (Ubuntu 12.04 and 14.04)

Each of these clients provides full SSL VPN tunnel functionality through NetScaler Gateway and supports all authentication methods available in NetScaler Gateway 11.

Additionally, the Mac OS and Windows plug-ins have been refreshed and updated for the 11.0 release, including OS X 10.10 (Yosemite) support for the Mac OS X plug-in.

Plug-in Version Decoupling

The NetScaler Gateway client plug-ins are no longer coupled to the Citrix NetScaler Gateway 11 release versioning. Settings for version requirement per client OS type can be configured globally and within session policies.

Plug-in Icon Decoupling from Citrix Receiver

The desktop client plug-ins icons can now be configured to operate independently from Native Citrix Receiver clients. Settings to manage Receiver integration with the NetScaler Gateway Plug-ins can be configured globally and within session policies.

Disabling Automatic Update for the Windows Gateway Client and EPA Plug-ins

This enhancement adds an option in client Endpoint Analysis (EPA) to prevent automatic client updates by disabling the “EnableAutoUpdate” registry key.

Striped Cluster for Citrix NetScaler Gateway 11 in ICA Proxy Mode

This feature allows administrators to deploy NetScaler Gateway with XenApp and XenDesktop in a striped cluster configuration. Administrators can use existing Gateway configurations and scale seamlessly in a cluster deployment without having to restrict the VPN configuration to a single node.

Note that this feature is limited to ICA Proxy basic-mode virtual servers and does not support SmartAccess.

Clientless VPN support for Outlook Web Access 2013 and SharePoint 2013

NetScaler Gateway has improved support for access to Outlook Web Access 2013 and SharePoint 2013 through Clientless VPN (CVPN) sessions.

WebFront

WebFront is an alternative integration point for XenApp and XenDesktop deployments served by StoreFront. Resident on NetScaler, WebFront uses caching and packet flow optimization in the distribution of user stores. These techniques improve end user experience for Receiver for Web users and speed up single sign-on for native Receiver users. In the NetScaler configuration utility, the WebFront feature is on the Configuration tab at System > WebFront.

ICA Proxy Connection Termination after Session Time Out

Automatic session timeout can be enabled for ICA connections as a VPN parameter. Enabling this parameter forces active ICA connections to time out when a VPN session closes.

Support for Common Gateway Protocol (CGP) over WebSockets

NetScaler Gateway virtual servers have improved intelligence for handling CGP traffic destined for the common CGP port, 2598, over WebSockets. This enhancement allows Receiver for HTML5 user sessions through NetScaler Gateway to support Session Reliability.

SPNEGO Encapsulation for Kerberos Tickets

NetScaler now uses SPNEGO encapsulation on Kerberos tickets that are sent to back-end web applications and servers.

Cross Domain Kerberos Constrained Delegation 

This enhancement adds support for cross-domain Kerberos constrained delegation when both the user and the service realm have a two-way shortcut trust. That is, if the user and service belong to different domains/realms, constrained delegation fails. However, if a user logs on with a user name and password, Kerberos Single Sign-On works for cross-domain access, because the NetScaler Gateway appliance does Kerberos impersonation with the user password. NetScaler Gateway currently does not otherwise support cross-domain constrained delegation.

 

Source

Download Citrix Netscaler Gateway 11 build 55.20 here (requires MyCitrix ID)

Citrix technology professional – CTP, and Microsoft Most Valuable Professional MVP, Thomas Poppelgaard provides professional services. Write to me on my email thomas@poppelgaard.com or call on my cell +45 53540356

Citrix Receiver 13 for Linux

Citrix have released Receiver 13 for Linux. This release is an amazine Receiver from Citrix that features lots of new powerfull features. Thin client vendors like Dell Wyse is going to be very happy about this release cause the user experience is truely amazing with this new client.

Check out this cool video Vipin Borkar from Citrix have created, where you see the powerfull new features

http://www.citrix.com/tv/#videos/9555

Whats new in Receiver 13 for Linux

  • Support for XenDesktop 7 features – Receiver supports many of the new features and enhancements in XenDesktop 7, including Windows Media client-side content fetching, HDX 3D Pro, HDX RealTime webcam compression, Server-rendered Rich Graphics, and IPv6 support.
    Note: Link-local network addresses are not supported in IPv6 environments. You must have at least one global or unique-local address assigned to your network interface.
  • VDI-in-a-Box support – You can use Receiver to connect to virtual desktops created with Citrix VDI-in-a-Box.
  • Self-service UI – A new graphical user interface (UI), like that in other Citrix Receivers, replaces the configuration manager, wfcmgr. After they are set up with an account, users can subscribe to desktops and applications, and then start them.
  • Deprecated and removed utilities – The pnabrowse command-line utility is deprecated in favor of the new storebrowse command-line utility. The icabrowse and wfcmgr utilities have been removed.
  • StoreFront support – You can now connect to StoreFront stores as well as Citrix XenApp sites (also known as Program Neighborhood Agent sites).
  • UDP audio support – Most audio features are transported using the ICA stream and are secured in the same way as other ICA traffic. User Datagram Protocol (UDP) Audio uses a separate, unsecured, transport mechanism, but is more consistent when the network is busy. UDP Audio is primarily designed for Voice over IP (VoIP) connections and requires that audio traffic is of medium quality (that is Speex wideband) and unencrypted.
  • Packaging – An armhf (hard float) Debian package and tarball are now included in the download packages. In addition, the Debian package for Intel systems uses multiarch (a Debian feature) for installations on 32- and 64-bit systems. 32-bit binaries are also available in RPM packages.
  • System Flow Control – Video display has been enhanced on low-performance user devices that connect to high-performance servers. In such setups, System Flow Control prevents sessions becoming uncontrollable and unusable.
  • Localization – Receiver is now available in German, Spanish, French, Japanese, and Simplified Chinese.
  • Keyboard improvements – You can now specify which local key combination (Ctrl+Alt+End or Ctrl+Alt+Enter) generates the Ctrl+Alt+Delete combination on a remote Windows desktop. In addition, a new option supports Croatian keyboard layouts.
  • Deferred XSync – While one frame is still on screen, Receiver can now decode tiles for the next frame. This provides a performance improvement compared with previous releases, in which Receiver waited for a frame to finish being displayed before decoding the next frame.
  • Audio and webcam playback improvements – Various changes are implemented that conserve CPU cycles and reduce latency.
  • Audio settings – Several new audio settings are now available in module.ini.

Source

Download Citrix Receiver 13 for Linux here

Vipin Borkar CTX blogpost about Reciever 13 for Linux new features