Feature policy bypass through URL-based expressions on NetScaler (CVE-2026-88774)
Feature policy bypass through URL-based expressions on NetScaler (CVE-2026-88774) Five of the eight CVEs in the September 2026 NetScaler advisory are rated 8.8 or above, which makes the lowest-scoring entry easy to overlook. That entry is CVE-2026-88774 at 7.0, and it concerns something administrators configure deliberately: HTTP URL-based policy expressions. The advisory says misuse of those…
CVE-2026-88774 is a vulnerability affecting NetScaler appliances that allows for the bypass of feature policies through HTTP URL-based policy expressions. This issue is rated 7.0 on the CVSS v4 scale, making it less severe than other vulnerabilities in the same advisory. However, it still poses a risk, as it can only be exploited if HTTP URL-based policy expressions have been configured.
The vulnerability is present in NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and NetScaler ADC FIPS versions before 14.1-73.37 FIPS and NDcPP versions before 13.1-37.279. Citrix has released security updates to address the issue, and the NCSC recommends applying these updates as soon as possible.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
