7.2

CVE-2026-88774

Warnung

Feature policy bypass due to improper HTTP URL based expression usage

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Citrix ≫ Netscaler Application Delivery Controller SwEdition - Version >= 13.1 < 13.1-64.23
Citrix ≫ Netscaler Application Delivery Controller SwEdition fips Version >= 13.1 < 13.1.37.279
Citrix ≫ Netscaler Application Delivery Controller SwEdition ndcpp Version >= 13.1 < 13.1.37.279
Citrix ≫ Netscaler Application Delivery Controller SwEdition - Version >= 14.1 < 14.1-73.37
Citrix ≫ Netscaler Application Delivery Controller SwEdition fips Version >= 14.1-66.68 <= 14.1-73.37
Citrix ≫ NetScaler Gateway Version >= 13.1 < 13.1-64.23
Citrix ≫ NetScaler Gateway Version >= 14.1 < 14.1-73.37
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.137
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 3.9 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
50a63c94-1ea7-4568-8c11-eb79e7c5a2b5 7 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
Vendor Advisory