CVE-2026-88774: Feature policy bypass due to improper HTTP URL based expression usage
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
Affected Software
Event History
Frequently Asked Questions
Which NetScaler ADC releases require remediation?
ADC releases earlier than 14.1-73.37 or 13.1-64.23 are affected. ADC FIPS releases earlier than 14.1-73.37 FIPS, and ADC 13.1 FIPS and NDcPP releases earlier than 13.1.37.279, are also affected.
Which NetScaler Gateway releases are affected?
Gateway releases earlier than 14.1-73.37 and earlier than 13.1-64.23 are affected. The provided information does not identify Gateway FIPS or NDcPP releases as affected.
How can I determine whether an appliance is affected?
Identify whether the appliance is running ADC or Gateway, then compare its installed release against the applicable fixed version. Any release earlier than the stated version for its product and edition should be treated as affected.