Search threats, CVEs… ⌘K
← Back to CVE intelligence
CVE intelligence

CVE-2026-88774

Citrix NetScaler HTTP URL policy bypass

Published Sep 27, 2026Sources checked Nov 11, 2026
7.2HIGHCVSS out of 10
What this means

Review the available evidence

CVE-2026-88774 and is rated High severity with a CVSS score of 7.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

Public exploit: Not collected.

What to do next

Remediation and response

  • Upgrade to the fixed build for your branch: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 FIPS/NDcPP, or a later release listed by Citrix.
  • Check policy expressions that use HTTP URLs against the prerequisites in the Citrix bulletin.

Citrix Security Bulletins guidance

Vendor revision: Oct 12, 2026
Vendor remediation details

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1 Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP NetScaler deployments impacted by CVE-2026-88778 should apply the TCP configuration change as mentioned in https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation

Vendor-listed releases

  • Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases
  • Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1
  • Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
  • Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP
CISA KEVNot listedBased on the latest collected catalog
EPSS0.4%Estimated 30-day exploitation probability
Ransomware useNot markedCISA KEV ransomware field
Threat actors0Source-linked actor relationships
Overview

What is CVE-2026-88774?

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

Source: NVD

Vendor context

Citrix lists fixed releases for customer-managed NetScaler ADC and Gateway. Check policy expressions that use HTTP URLs against the prerequisites in the Citrix bulletin.

Citrix · Published Sep 27, 2026