NetScaler policy bypass via URL expressions in CVE-2026-88774

Citrix's September 2026 NetScaler advisory covers eight CVEs, including CVE-2026-88774 (CVSS 7.0), which lets attackers bypass a configured feature policy via HTTP URL-based expressions. Two flaws rated 9.5 are already exploited in the wild; fixes ship in 14.1-73.37 and 13.1-64.23.

• CVE-2026-88774: CVSS 7.0, policy bypass with URL-based expressions
• CVE-2026-88771 and CVE-2026-88772 (9.5) confirmed exploited
• Fixed builds: 14.1-73.37, 13.1-64.23, FIPS 13.1-37.279
• ZoomEye: about 239,300 internet-reachable NetScaler instances