CVE-2026-88774 Overview
CVE-2026-88774 is a feature policy bypass vulnerability in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway. The flaw stems from improper HTTP URL based expression usage, allowing network-based attackers to bypass policy enforcement without authentication. Citrix issued a security bulletin covering this issue alongside seven related CVEs. The vulnerability is classified under [CWE-20] Improper Input Validation and affects both standard and FIPS/NDcPP builds of NetScaler ADC, as well as NetScaler Gateway deployments.
Critical Impact
Unauthenticated network attackers can bypass configured feature policies on NetScaler ADC and Gateway appliances, potentially exposing protected resources and altering the security posture of downstream systems.
Affected Products
- Citrix NetScaler ADC before 14.1-73.37 and before 13.1-64.23
- Citrix NetScaler ADC FIPS before 14.1-73.37 FIPS and NDcPP before 13.1.37.279
- Citrix NetScaler Gateway before 14.1-73.37 and before 13.1-64.23
Discovery Timeline
- 2026-09-27 - CVE-2026-88774 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-88774
Vulnerability Analysis
The vulnerability resides in how NetScaler ADC and Gateway evaluate HTTP URL based policy expressions. When administrators configure feature policies that rely on URL matching for access control, request routing, or security enforcement, the policy engine fails to normalize or validate request URLs correctly. Attackers craft HTTP requests that evade the expression match while still reaching the intended backend feature.
The attack requires no authentication and executes over the network against the appliance management or data plane. According to the CVSS 4.0 vector, the impact extends to subsequent systems with high confidentiality and integrity consequences on downstream components, reflecting NetScaler's role as a traffic broker.
Root Cause
The root cause is improper input validation [CWE-20] in HTTP URL based expression handling. Policy expressions evaluating request URLs do not account for all equivalent URL representations. This mismatch between how the policy engine parses a URL and how downstream features interpret the same request creates a bypass primitive.
Attack Vector
An unauthenticated attacker sends specially crafted HTTP requests to a NetScaler ADC or Gateway endpoint protected by URL-based feature policies. By manipulating URL encoding, path segments, or expression-triggering characters, the attacker causes the policy evaluation to return a result inconsistent with the request actually serviced. The attack complexity is low, though a passive attack prerequisite exists in the environment.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.241%.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-88774
Indicators of Compromise
- HTTP requests to NetScaler ADC or Gateway with abnormal URL encoding, mixed-case path segments, or duplicate slashes targeting URLs that should be restricted by policy.
- Access log entries showing successful requests to backend features that URL-based policies were configured to block.
- Unexpected policy hit counters or AppFlow records that do not align with observed backend activity.
Detection Strategies
- Correlate NetScaler policy evaluation logs with backend application logs to identify requests that reached protected features despite policy configuration.
- Hunt for repeated requests from a single source using varied URL normalization patterns against the same endpoint.
- Baseline normal URL patterns on exposed NetScaler virtual servers and alert on deviations such as encoded path traversal sequences or non-standard separators.
Monitoring Recommendations
- Enable verbose policy and AppFlow logging on NetScaler ADC and Gateway and forward logs to a central SIEM for retention and analysis.
- Monitor the Citrix security bulletin CTX697096 for updates and additional guidance.
- Track administrative access to NetScaler management interfaces and alert on policy configuration changes that follow suspicious traffic.
How to Mitigate CVE-2026-88774
Immediate Actions Required
- Inventory all NetScaler ADC and NetScaler Gateway appliances and identify builds older than 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1.37.279 FIPS/NDcPP.
- Upgrade affected appliances to the fixed versions listed in the Citrix security bulletin as the primary remediation.
- Review all URL-based feature policies and audit recent access logs for traffic patterns consistent with bypass attempts.
Patch Information
Citrix has released fixed builds that address CVE-2026-88774. Administrators should upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.37 or 13.1-64.23, and FIPS/NDcPP deployments to 14.1-73.37 FIPS or 13.1.37.279. Full remediation details are documented in the Citrix Security Bulletin CTX697096.
Workarounds
- No vendor-supplied workaround is published; upgrading to a fixed build is the only supported fix.
- Where immediate patching is not feasible, restrict exposure of NetScaler management and sensitive virtual server endpoints to trusted network segments.
- Review URL-based policy expressions and, where possible, add defense-in-depth checks at the backend application layer to validate authorization independently of NetScaler policy outcomes.
# Verify current NetScaler build before and after upgrade
show ns version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
