CVE-2026-88774

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-88774
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
History

29 Sep 2026, 16:17

Type Values Removed Values Added
CWE CWE-20

28 Sep 2026, 14:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
CWE NVD-CWE-noinfo
References () https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778 - () https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778 - Vendor Advisory
CPE cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*
First Time Citrix netscaler Application Delivery Controller
Citrix netscaler Gateway
Citrix

28 Sep 2026, 09:10

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad en Citrix NetScaler ADC y Citrix NetScaler Gateway. Este problema afecta a ADC: antes de 14.1-73.37, antes de 13.1-64.23, antes de 14.1-73.37 FIPS, y antes de 13.1.37.279 FIPS y NDcPP; Gateway: antes de 14.1-73.37 y antes de 13.1-64.23, lo que lleva a una omisión de la política de características debido a un uso incorrecto de expresiones basadas en URL HTTP.

27 Sep 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-27 17:16

Updated : 2026-09-29 16:17

NVD link : CVE-2026-88774

Mitre link : CVE-2026-88774

CVE.ORG link : CVE-2026-88774

JSON object : View

Products Affected

citrix

  • netscaler_gateway
  • netscaler_application_delivery_controller
CWE
NVD-CWE-noinfo CWE-20

Improper Input Validation