CVE-2026-88774

highpriority · track · 29EPSS 0.002 · 14 %ileDENLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (14th) EPSS

CVSS 7.2 · high

Is it mine?

22 products

Check your exposure

Who says so?

3 sources

cert_bund · ncsc_nl · nvd

EPSS · scored 2026-10-22

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

cvss

Technical severity, 0–10. One row per scoring source.

7.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.7–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 2.7

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · NCSC-NL NL

v4.07highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.02.7lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20US

affected products (22)

Products and version ranges known to be affected.

Citrix Systems NetScaler ADC <13.1-64.23all versionscert_bundDE
Citrix Systems NetScaler ADC <14.1-73.37all versionscert_bundDE
Citrix Systems NetScaler ADC FIPS <13.1-37.279all versionscert_bundDE
Citrix Systems NetScaler ADC FIPS <14.1-73.37all versionscert_bundDE
Citrix Systems NetScaler ADC NDcPP <13.1-37.279all versionscert_bundDE
Citrix Systems NetScaler Gateway <13.1-64.23all versionscert_bundDE
Citrix Systems NetScaler Gateway <14.1-73.37all versionscert_bundDE
Citrix Systems NetScaler≤ ADC NDcPP <13.1-37.279cert_bundDE
Citrix Systems NetScaler≤ ADC <13.1-64.23cert_bundDE
Citrix Systems NetScaler≤ ADC <14.1-73.37cert_bundDE
Citrix Systems NetScaler≤ ADC FIPS <13.1-37.279cert_bundDE
Citrix Systems NetScaler≤ ADC FIPS <14.1-73.37cert_bundDE
Citrix Systems NetScaler≤ Gateway <13.1-64.23cert_bundDE
Citrix Systems NetScaler≤ Gateway <14.1-73.37cert_bundDE
Citrix NetScaler ADC≤ vers:unknown/*ncsc_nlNL
Citrix NetScaler Gateway≤ vers:unknown/*ncsc_nlNL
citrix netscaler application delivery controller13.1 → 13.1-64.23nvdUScpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:*:*:*:*
citrix netscaler application delivery controller13.1 → 13.1.37.279nvdUScpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:*:*:*:*
citrix netscaler application delivery controller14.1 → 14.1-73.37nvdUScpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:*:*:*:*
citrix netscaler application delivery controller14.1-66.68 → 14.1-73.37nvdUScpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:*:*:*:*

showing 20 of 22

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0394Kwetsbaarheden verholpen in NetScaler ADC en NetScaler GatewayNL2026-09-27csaf · ncsc_nlNL
Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar: - Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 vóór versie 14.1-73.37 - Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 vóór versie 13.1-64.23 - Citrix NetScaler ADC FIPS vóór versie 14.1-73.37 FIPS - Citrix NetScaler ADC FIPS en NDcPP vóór versie 13.1-37.279 Secure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden. Deze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (“NetScaler ADC”) en Citrix NetScaler Gateway-systemen (“NetScaler Gateway”). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.
WID-SEC-W-2026-3587Citrix NetScaler ADC und Citrix NetScaler Gateway: Mehrere SchwachstellenDeutsch2026-09-27csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Citrix NetScaler ADC und Citrix NetScaler Gateway ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und weitere, nicht näher bezeichnete Auswirkungen zu erzielen.

sources

Which sources assert this record, and when.

cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2026-09-27modified 2026-09-29

references (1) nvd

External citations — patches, advisories, analysis.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778Vendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan