Feature policy bypass through URL-based expressions on NetScaler (CVE-2026-88774)

Feature policy bypass through URL-based expressions on NetScaler (CVE-2026-88774) Five of the eight CVEs in the September 2026 NetScaler advisory are rated 8.8 or above, which makes the lowest-scoring entry easy to overlook. That entry is CVE-2026-88774 at 7.0, and it concerns something administrators configure deliberately: HTTP URL-based policy expressions. The advisory says misuse of those expressions can lead to bypassing a feature policy. CVE-2026-88776, the memory overflow this topic is filed under, shares the same patch. Vulnerability set at a glance CVE CVSS v4 Weakness and outcome Precondition Exploitation CVE-2026-88771 9.5 Insufficient input validation; unauthenticated remote command execution All ADC and Gateway deployments Confirmed exploited CVE-2026-88772 9.5 Memory overflow allowing remote code execution or denial of service DTLS enabled (default on a VPN virtual server) Confirmed exploited CVE-2026-88773 9.3 HTTP request smuggling HTTP functionality enabled Not reported CVE-2026-88774 7.0 Feature policy bypass via HTTP URL-based policy expressions URL-based policy expressions configured Not reported CVE-2026-88775 8.8 Memory overflow causing unpredictable behaviour or denial of service Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server Not reported CVE-2026-88776 8.8 Memory overflow causing unpredictable behaviour or denial of service Oracle-type load-balancing virtual server Not reported CVE-2026-88777 8.8 Memory overflow causing unpredictable behaviour or denial of service LB, CS or CGNAT-LSN/NAT64 with a non-HTTP Layer 7 protocol Not reported CVE-2026-88778 8.8 Predictable TCP initial sequence numbers TCP functionality enabled Not reported Why a policy bypass deserves attention Policies on a NetScaler appliance are where routing, access and security decisions live. A flaw that lets those decisions be bypassed targets the control plane rather than the data plane, and the affected configuration is one an administrator has explicitly chosen to use. The advisory is careful with its scope statement: CVE-2026-88774 applies only when HTTP URL-based policy expressions have been configured. That narrows the exposed population but does not make the outcome trivial for the organisations inside it. The rest of the release The two flaws Citrix has seen exploited in the wild are CVE-2026-88771 and CVE-2026-88772, both at 9.5. CVE-2026-88773 brings HTTP request smuggling at 9.3. Four memory overflow and predictability issues sit at 8.8, including CVE-2026-88776, whose trigger is an Oracle-type load-balancing virtual server. Impact The disclosed impact of CVE-2026-88774 is bypass of a configured feature policy. Where policy is the mechanism enforcing who may reach what, a bypass undermines that enforcement without needing to break the target application. Affected products and scope NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37 NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23 NetScaler ADC FIPS before 14.1-73.37 FIPS NetScaler ADC FIPS and NDcPP before 13.1-37.279 Remediation Citrix has issued security updates and the NCSC recommends applying them without delay. The fixed builds are: 14.1-73.37 and later (14.1 branch) 13.1-64.23 and later (13.1 branch) 14.1-73.37 FIPS and later (FIPS branch) 13.1-37.279 and later (FIPS / NDcPP branch) Because CVE-2026-88771 and CVE-2026-88772 have been observed in the wild, the NCSC adds guidance that goes beyond a normal patch cycle. Before installing the update, preserve relevant logging and take a memory dump, so that forensic evidence of any earlier compromise remains available. Installing the update stops new exploitation but does not rule out that a system was already breached, so organisations that were exposed before patching should also assess for prior compromise. Exposure context A ZoomEye search with the product fingerprint app="Citrix NetScaler" reports 239.3k matching instances, which places the population of internet-reachable NetScaler deployments well above the threshold at which this class of flaw warrants urgent attention. NetScaler appliances commonly sit directly on the internet as VPN concentrators and load balancers, so a reachable management or data plane usually means no additional network foothold is needed to attempt exploitation. Sources NCSC-2026-0394, Netherlands Cyber Security Center, 27 September 2026. Citrix security bulletin CTX697096 for CVE-2026-88771 through CVE-2026-88778.