All vulnerabilities
CVE-2026-88774

ADC: Feature policy bypass due to improper HTTP URL based expression usage

Citrix NetScaler ADCNetwork & edge
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in14.1-73.37Also 13.1-64.23, 14.1-73.37 FIPS and 1 moreCVE List
Published27 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 27 Sep 2026, 16:14 UTCPublishedCVE List
  2. 28 Sep 2026, 10:55 UTCFirst reportwatchTowr Labs
  3. 23 Oct 2026, 23:39 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

Text from CVE List

Affected versions 6

  • ADCaffected: all versions before 14.1-73.37CVE List
  • ADCaffected: all versions before 13.1-64.23CVE List
  • ADCaffected: all versions before 14.1-73.37 FIPSCVE List
  • ADCaffected: all versions before 13.1.37.279 FIPS and NDcPPCVE List
  • Gatewayaffected: all versions before 14.1-73.37CVE List
  • Gatewayaffected: all versions before 13.1-64.23CVE List

References 1