It is vulnerable, but only the Management GUI which should not be accessible publicly. Make sure your management IPs are accepting only management traffic and limit what IP addresses can interact with them Citrix is working on a firmware that incorporates the CVE patch for PHP in it.