CVE-2026-88774
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
- Published Sep 27, 2026
- CVSS 7.0 high
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available
Affected software
In the news
- Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772 and others) JPCERT/CC ·
- Multiple Vulnerabilities in NetScaler ADC and NetScaler Gateway Could Allow for Remote Code Execution CIS MS-ISAC ·
- Citrix security advisory (AV26-965) Canadian Centre for Cyber Security ·
- Multiple vulnerabilities in Citrix NetScaler ADC and Gateway CERT-FR ·
- Critical Vulnerabilities in Citrix NetScaler ADC and Gateway CERT-EU ·
- Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway CISA ·