Vulnerability · Published Sep 27, 2026 · Assigned by NetScaler

CVE-2026-88774Feature policy bypass due to improper HTTP URL based expression usage

High 7.0

In plain English

A high-severity improper input validation in ADC from Citrix NetScaler. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.4%top 66.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

Affected products (as reported)

Vendor	Product	Versions
Citrix NetScaler	ADC	0 – before 14.1-73.370 – before 13.1-64.230 – before 14.1-73.37 FIPS0 – before 13.1.37.279 FIPS and NDcPP
Citrix NetScaler	Gateway	0 – before 14.1-73.370 – before 13.1-64.23

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778