CVE-2026-88774

Feature policy bypass due to improper HTTP URL based expression usage

No known exploitation. EPSS puts it in the 14th percentile. Fixed versions are out.

CVSS 3.17.2High EPSS percentile14th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4 products4 fixed builds listed below

Published 2026-09-27Updated 2026-09-29Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Citrix NetScaler ADCAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Affected: < 14.1-73.37 FIPSUpgrade to: 14.1-73.37 FIPSAffected: < 13.1.37.279 FIPS and NDcPPUpgrade to: 13.1.37.279 FIPS and NDcPPStated by: CVE record
Citrix NetScaler GatewayAffected: < 14.1-73.37Upgrade to: 14.1-73.37Affected: < 13.1-64.23Upgrade to: 13.1-64.23Stated by: CVE record
Citrix Netscaler Application Delivery ControllerAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-64.23Upgrade to: 13.1-64.23Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Citrix NetScaler ADC or Gateway and identify its installed version and edition.
Upgrade standard ADC or Gateway to 14.1-73.37 or 13.1-64.23, as appropriate.
Upgrade ADC FIPS to 14.1-73.37 FIPS, or ADC FIPS and NDcPP to 13.1.37.279 FIPS and NDcPP.
If an upgrade must wait, remove affected appliances from internet exposure where operationally possible and ask your IT provider to assess access logs for unusual requests.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

In plain language

Written by AI from the record

Citrix NetScaler ADC and Gateway versions earlier than 14.1-73.37 or 13.1-64.23, including the listed FIPS editions, have a flaw that can let an outsider bypass security checks, so affected small businesses should act now.

Unauthenticated network-accessible feature-policy bypass in Citrix NetScaler ADC and Gateway caused by improper handling of HTTP URL-based expressions, with confidentiality and integrity impact.

If you're affected

Security controls bypassed
Sensitive data exposure
Unauthorized traffic changes
Service-policy disruption

What is it

This is a mistake in how the appliance interprets parts of web addresses when applying its security rules. It is like a building receptionist accepting a cleverly formatted visitor pass and letting someone around controls intended to protect private areas.

Who is affected

This matters to you if you use or run Citrix NetScaler ADC and Gateway to deliver applications or provide remote access. The issue affects the specified older releases and does not require the attacker to have an account or persuade an employee to do anything. It is only a practical risk where an attacker can reach the affected appliance over the network.

How urgent is it

This is urgent because an outsider can remotely bypass security features on an affected appliance without logging in. Upgrade affected systems promptly, particularly any exposed to the internet; the findings do not confirm active exploitation or inclusion in CISA's known-exploited catalog.

What to do — in detail

Confirm the appliance product, edition, and running build, then determine whether untrusted networks can reach its web-facing services. Upgrade standard Citrix NetScaler ADC or Gateway to 14.1-73.37 or 13.1-64.23; upgrade ADC FIPS to 14.1-73.37 FIPS; and upgrade ADC FIPS and NDcPP to 13.1.37.279 FIPS and NDcPP. Review the vendor bulletin and release notes before scheduling the upgrade for environment-specific compatibility considerations.

If patching is delayed, remove direct internet reachability or limit access to trusted networks where feasible; this reduces exposure but does not replace upgrading. No CISA KEV remediation deadline applies because this CVE is not listed in KEV. After remediation, review appliance and upstream access logs for unexpected HTTP requests or security-policy behavior around the upgrade window; the findings do not identify a specific indicator of compromise.

Technical context

CVE-2026-88774 is rated CVSS 7.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). It is a CWE-20 improper-input-validation issue involving HTTP URL-based expressions that enables an unauthenticated network attacker to bypass feature policy controls, with potential confidentiality and integrity impact. CISA KEV does not list this CVE, no clear dated press claim confirms exploitation, and no public exploit code is on record. EPSS is 0.2% (14th percentile) with a flat trend; this is a prediction rather than evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS14th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 14th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 2 days, from the signal feeds we watch.

2026-09-29Patch availablerecord updated
2026-09-28Patch availablerecord updated, record updated
2026-09-27Publishedweakness classified, att&ck mapped, record updated

Affected products

Citrix NetScaler
- ADC
- Gateway
citrixcommercial · USaka xenserver, application delivery controller firmware, netscaler gateway firmware
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Scored 7.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact