{
  "id": 15057732,
  "title": "Feature policy bypass through URL-based expressions on NetScaler (CVE-2026-88774)",
  "url": "https://urgent.news/2026/10/16/feature-policy-bypass-through-url-based-expressions-on-netscaler-cve",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-16T22:21:25.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/stark_zhuang_df5076f35c68/feature-policy-bypass-through-url-based-expressions-on-netscaler-cve-2026-88774-56cp"
  },
  "original_language": "en",
  "account": "CVE-2026-88774 is a vulnerability affecting NetScaler appliances that allows for the bypass of feature policies through HTTP URL-based policy expressions. This issue is rated 7.0 on the CVSS v4 scale, making it less severe than other vulnerabilities in the same advisory. However, it still poses a risk, as it can only be exploited if HTTP URL-based policy expressions have been configured. The vulnerability is present in NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and NetScaler ADC FIPS versions before 14.1-73.37 FIPS and NDcPP versions before 13.1-37.279. Citrix has released security updates to address the issue, and the NCSC recommends applying these updates as soon as possible.",
  "summary": "Feature policy bypass through URL-based expressions on NetScaler (CVE-2026-88774) Five of the eight CVEs in the September 2026 NetScaler advisory are rated 8.8 or above, which makes the lowest-scoring entry easy to overlook. That entry is CVE-2026-88774 at 7.0, and it concerns something administrators configure deliberately: HTTP URL-based policy expressions. The advisory says misuse of those…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}