CVE Alert: CVE-2026-88774 – Citrix NetScaler

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

**Risk verdict:** Treat this as a significant exposure for internet-reachable deployments, but exploitation urgency cannot be confirmed because KEV, SSVC, EPSS and PoC data were not provided.

**Why this matters:** A bypass of URL-driven feature policies can undermine controls intended to restrict access to applications or functions. The assessed impact indicates potential consequences for systems behind the appliance, making unauthorised access to sensitive data or changes to downstream services realistic attacker goals; service disruption is less directly indicated.

**Most likely attack path:** An attacker sends crafted HTTP requests over the network; exploitation needs no credentials or user action and is rated low complexity, but a specific, currently unspecified attack condition must be present. The high impact beyond the vulnerable component means a bypass could affect connected services, although the extent depends on policy design and network segmentation.

**Who is most exposed:** Prioritise internet-facing traffic-management and remote-access gateways, especially those using URL-based policies to control access to internal applications.

Review gateway logs for unusual URL encodings, path variants or requests matching protected routes unexpectedly.

Compare policy-evaluation logs with backend access logs for requests allowed contrary to intended rules.

Check for anomalous access to sensitive applications following requests to the gateway.

Preserve relevant request, policy and authentication logs for investigation.

Mitigation and prioritisation:

Apply the vendor’s fixed release for the deployed branch as soon as change controls permit.

Until patched, disable or narrow affected URL-based policies where feasible; restrict exposure and backend reachability.

Validate policy behaviour with representative crafted URL cases after remediation.

Obtain current KEV, SSVC, EPSS and exploitation reporting before setting final urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.