Cyber Resilience

CVE-2026-88774

Citrix Netscaler Application Delivery Controller 13.1 – 13.1-64.23

UK NCSC Alert
Published
27 September 2026
Modified
28 September 2026
Patch / advisory
View advisory
CVSS Score v4 7.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0033 24th percentile
Risk Priority 41 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-88774 is a high-severity an unspecified weakness vulnerability in Citrix Netscaler Application Delivery Controller. Its CVSS base score is 7.0 (High).

Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to…

more

improper HTTP URL based expression usage.

CWE(s)
NVD-CWE-noinfo

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

citrix
netscaler application delivery controller
13.1 — 13.1-64.23 · 13.1 — 13.1.37.279 · 13.1 — 13.1.37.279
citrix
netscaler gateway
13.1 — 13.1-64.23 · 14.1 — 14.1-73.37

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References