CVE-2026-88774

Executive Summary

CVE-2026-88774 is a feature policy bypass vulnerability affecting Citrix NetScaler ADC (Application Delivery Controller) and Citrix NetScaler Gateway appliances. The flaw arises from improper usage of HTTP URL-based expressions within policy configurations, allowing an attacker to circumvent policy enforcement controls. Organizations running affected firmware branches (14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and corresponding FIPS/NDcPP builds) are exposed if their deployed policies rely on HTTP URL-based expressions to gate access to protected resources.

Technical Analysis

The NVD description states that this issue "leading to a feature policy bypass due to improper HTTP URL based expression usage." This places the vulnerability in the authorization/policy-enforcement weakness class (CWE-863, Incorrect Authorization) rather than an injection or memory-safety class. The core defect is that policy expressions constructed against HTTP URL content are evaluated or matched incorrectly, so requests that should be denied (or should be subject to a stricter policy action) are instead permitted.

Citrix NetScaler ADC and Gateway use a policy expression engine in which administrators define rules that inspect request attributes — including URL-based attributes — to decide whether a request is allowed, denied, redirected, or subject to additional controls (authentication, authorization, responder actions, and similar). Because the vulnerability is explicitly tied to "improper HTTP URL based expression usage," the weakness lies in how the platform parses or normalizes the URL component of a request when comparing it against the configured expression. Attackers can therefore craft requests whose URL representation does not match the administrator's intended policy semantics while still being routed to the protected resource. In effect, the policy engine's view of the URL diverges from the backend service's view of the same request (a canonicalization/parsing mismatch), which is the classic precondition for policy bypass.

The precise parsing or canonicalization defect — for example, whether it involves encoding variants, path normalization, query-string handling, or case sensitivity — is not disclosed in the available NVD description or CNA title. Insufficient technical detail is available to describe the exact malformed input that triggers the mismatch. What can be stated with confidence from the description alone is:

• The attack surface is the HTTP(S) request URL as processed by the NetScaler policy expression engine.
• The exploit precondition is a deployment in which security decisions depend on HTTP URL-based expressions.
• The outcome is a "feature policy bypass" — the configured policy action is not applied as intended.

No CWE identifier, CVSS vector, or CVSS score was provided in the source data; the CWE and MITRE mapping above are analyst inferences based on the described impact class and are labeled as such. No public proof-of-concept, nuclei template, or exploit code was identified in tracked sources, and the vulnerability is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (HTTP URL-based policy bypass) and the vendor/product context provided in the NVD description. No specific function names, endpoints, or parameters are asserted because none are present in the source data.

1. Reconnaissance / target identification An adversary identifies internet-facing or internally reachable Citrix NetScaler ADC/Gateway management or traffic-handling interfaces, for example via Shodan queries such as product:"Citrix NetScaler" or http.title:"Citrix Gateway". The adversary maps which protected resources sit behind policy enforcement that is likely to rely on URL-based expressions (for example, paths gated by responder or authorization policies). Because the flaw is a policy bypass rather than a pre-authentication RCE, the attacker's goal at this stage is to enumerate URLs and confirm which ones are subject to URL-expression policies.

2. Triggering the flaw class The attacker sends crafted HTTP(S) requests in which the URL is represented in a way that the policy expression engine evaluates differently from how the origin service interprets it. This is the standard technique family for policy-bypass via URL parsing/canonicalization mismatch: alternate encodings, path traversal-style normalization differences, duplicate or altered separators, and case variants are the general classes of input that historically induce this failure mode. The precise input is not documented in the available data. The defining property is that the request evades the administrator's URL-based expression match while still being delivered to the intended backend resource.

3. Payload / execution method No code execution is implied by the description. The "execution" is the delivery of a request that reaches a resource or functionality that the URL-based policy was intended to restrict. There is no evidence in the source data of memory corruption, command injection, or file write; the impact is unauthorized access to policy-protected features.

4. Post-exploitation impact Successful bypass means the attacker gains access to features, administrative surfaces, or backend resources that the policy was designed to block. Depending on what the bypassed policy protected, consequences could range from exposure of internal applications to access to administrative functionality. The blast radius is bounded by what the specific misconfigured/bypassed URL-expression policy guarded; the description does not enumerate affected features.

Impact Assessment

The primary impact is an authorization/policy-enforcement failure (feature policy bypass). The vulnerability does not, per the available description, provide code execution, so the immediate technical severity is a function of which controls the bypassed policy implemented. For organizations using HTTP URL-based expressions to enforce authentication, authorization, or access control on NetScaler ADC/Gateway, an attacker may reach resources that should have been denied.

Blast radius factors:

• Exposure: Any NetScaler ADC/Gateway deployment with HTTP URL-based policy expressions in the request path is potentially affected; edge deployments are internet-facing by design.
• Version scope: ADC before 14.1-73.37 and before 13.1-64.23; FIPS builds before 14.1-73.37 FIPS and before 13.1.37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. Note the 13.1.37.279 FIPS/NDcPP reference differs from the 13.1-64.23 branch, indicating separate maintenance trains.
• Regulatory exposure: FIPS and NDcPP builds are used in regulated and government environments, raising the stakes for any policy-enforcement bypass in those builds.

No CVSS subscores were supplied (CVSS Score: N/A, Vector: N/A), so no quantitative severity can be derived from the source data. EPSS is unscored. CISA KEV status: not listed. Given the product's role as a security and access-control enforcement point, the qualitative risk is elevated: a bypass of URL-based policy undermines a control that customers explicitly purchase the appliance to provide.

Detection Guidance

Sigma Rule

title: Citrix NetScaler ADC/Gateway HTTP URL Policy Bypass Attempt (CVE-2026-88774)
id: 3c9f1a72-7b2e-4d51-9a44-9f0c8e6b1d20
status: experimental
description: Detects HTTP requests to Citrix NetScaler ADC/Gateway with URL constructs (encoding, normalization, traversal, duplicate separators) indicative of attempts to evade HTTP URL-based policy expressions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88774
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: citrix
detection:
  selection_host:
    - cs-host|contains:
        - 'Citrix Gateway'
        - 'NetScaler'
  selection_url_anomalies:
    cs-uri|re: '(?i)(%2e%2e|%252e|\.\./|\.\.%2f|%2f%2f|//+|%00|%09|%0a|%0d)'
  selection_encoded_slashes:
    cs-uri|re: '(?i)(%2f|%5c){2,}'
  condition: selection_host and (selection_url_anomalies or selection_encoded_slashes)
falsepositives:
  - Legitimate applications that use encoded path segments
  - Security scanners
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.88774

YARA Rule

rule CITRIX_NETSCALER_POLICY_BYPASS_CVE_2026_88774
{
    meta:
        description = "Detects HTTP request lines containing URL constructs associated with Citrix NetScaler ADC/Gateway HTTP URL policy expression bypass (CVE-2026-88774)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88774"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $m1 = "GET " ascii nocase
        $m2 = "POST " ascii nocase
        $u1 = "%2e%2e" ascii nocase
        $u2 = "%252e" ascii nocase
        $u3 = "../" ascii
        $u4 = "%2f%2f" ascii nocase
        $u5 = "%5c" ascii nocase
        $h1 = "Citrix Gateway" ascii nocase
        $h2 = "NetScaler" ascii nocase

    condition:
        ($m1 or $m2) and
        any of ($u*) and
        any of ($h*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88774 Citrix NetScaler ADC/Gateway HTTP URL Policy Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Citrix Gateway"; nocase; http.uri; pcre:"/(%2e%2e|%252e|\.\.\/|%2f%2f|%00|%0a|%0d)/i"; classtype:attempted-user; reference:cve,2026-88774; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88774; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202688774; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where network.protocol == "http" and
     url.path : ("*%2e%2e*" or "*%252e*" or "*%2f%2f*" or "*%5c*" or "*..%2f*")]
  [network where network.protocol == "http" and
     http.response.status_code >= 200 and http.response.status_code < 300]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri, request_url)
| where match(uri, "(?i)(%2e%2e|%252e|\.\./|%2f%2f|%5c%5c|%00|%0a|%0d)")
| eval host_hdr=coalesce(dest, dest_host, cs_host, host)
| where match(host_hdr, "(?i)(Citrix|NetScaler)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as suspicious_uris by src_ip, host_hdr
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="citrix,web,cve-2026-88774,">
  <rule id="202688744" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>Citrix|NetScaler</match>
    <regex type="pcre2">(?i)(%2e%2e|%252e|\.\./|%2f%2f|%5c%5c|%00|%0a|%0d)</regex>
    <description>CVE-2026-88774: Possible Citrix NetScaler ADC/Gateway HTTP URL policy bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_initial_access,</group>
  </rule>

  <rule id="202688745" level="12">
    <if_sid>202688744</if_sid>
    <regex type="pcre2">(?i)(%2e%2e|%252e|\.\./|%2f%2f)</regex>
    <description>CVE-2026-88774: High-confidence URL normalization bypass pattern against Citrix NetScaler</description>
    <group>attack_initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Audit NetScaler ADC/Gateway configurations for any policy, responder, authorization, or access-control expressions that depend on HTTP URL attributes. Identify which protected resources those policies guard.
• Where possible, reduce reliance on URL-only expressions: layer additional enforcement mechanisms (authentication policies, network segmentation, upstream WAF rules) so that a single URL-expression bypass does not directly expose a protected resource.
• Restrict management-plane access to trusted networks; do not expose the management interface to the internet.
• Monitor logs for malformed or unusually encoded URLs directed at policy-protected paths (see Detection Guidance above).
• Treat FIPS/NDcPP deployments with heightened scrutiny given the regulated environments they protect.

2. Patch/upgrade steps

• No vendor advisory, patch reference, or fixed-version confirmation was present in the tracked data. The version ranges in the NVD description define the affected boundary (ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23), which implies fixed releases at or above those thresholds — but this must be validated against an official Citrix bulletin before acting.
• Confirm the availability of an official Citrix security advisory and appliance firmware for the relevant branch (14.1, 13.1, and the FIPS/NDcPP trains) prior to upgrading.
• Follow Citrix's documented upgrade procedure for the specific appliance role (ADC vs. Gateway) and branch; validate policy behavior post-upgrade before restoring full traffic.

3. Long-term hardening

• Maintain a firmware currency program; NetScaler appliances are high-value edge targets and historically attract rapid exploitation.
• Minimize the number of distinct URL-based policies and centralize change control over expression definitions to reduce misconfiguration risk.
• Implement defense-in-depth: an enforcing WAF or reverse proxy in front of NetScaler-protected resources can re-validate URL canonicalization independently.
• Continuously test policy enforcement with adversarial URL-encoding/normalization test cases as part of routine security validation.
• Subscribe to Citrix security bulletins and CISA advisories; monitor for KEV listing and exploit-in-the-wild reporting, which was absent at the time of writing.

References

1. NVD — CVE-2026-88774: https://nvd.nist.gov/vuln/detail/CVE-2026-88774
2. Citrix Security Bulletins (vendor advisory portal): https://support.citrix.com/security-bulletins (no advisory confirmed for this CVE in tracked sources)
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-88774 NOT listed at time of writing)
4. FIRST.org EPSS: https://www.first.org/epss (CVE-2026-88774 not yet scored)
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat actor campaigns or exploit-in-the-wild evidence were identified in the available data. No public PoC, exploit code, or Nuclei template was available.