CVE-2026-88774

HIGHCVSS 7.2

Description

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

Timeline

Published:September 27th, 2026 5:16 PM

Last modified:September 29th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 7.2 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected Software

From NVD CPE configuration data

Vendors

citrix

Products

netscaler_application_delivery_controllernetscaler_gateway

Weaknesses (CWE)

CWE-20

References & Reports

Advisories, patches, and third-party reports

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778Vendor Advisory

Source: NIST NVD · Data may lag official sources by up to one minute