EUVD-2026-87960
GHSA-m373-fcf4-9cxv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H reflects the 4.0 AT:P precondition; S:C and C:L/I:L capture policy bypass exposing a protected downstream feature with limited impact.
Primary rating from Vendor (NetScaler).
CVSS VectorVendor: NetScaler
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
AnalysisAI
Feature policy bypass in Citrix NetScaler ADC and Gateway allows unauthenticated remote attackers to evade certain configured policies when those policies use HTTP URL-based expressions, potentially bypassing policy enforcement controls. Affected are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a NetScaler ADC or Gateway configured with a feature policy that uses an HTTP URL-based expression - the flaw is that improper URL-based expression usage allows the policy to be evaded, so an environment with no such URL-scoped feature policies is not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 7.0 (HIGH), but the vector tells a more nuanced story: AV:N/AC:L means network-reachable and low-complexity, PR:N/UI:N means no authentication or user interaction, yet AT:P signals a specific attack requirement (a precondition outside the attacker's control) that constrains reliable exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade NetScaler ADC to 14.1-73.37 or later, 13.1-64.23 or later, 14.1-73.37 FIPS or later, and 13.1.37.279 FIPS/NDcPP or later; upgrade NetScaler Gateway to 14.1-73.37 or later and 13.1-64.23 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Citrix NetScaler ADC and Gateway instances to identify those running versions prior to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1.37.279 FIPS/NDcPP, and review configurations for any feature policies that use HTTP URL-based expressions; temporarily disable or tighten these policies if business-critical functions allow. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the c
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding F
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway applia
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos An
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredict
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CV
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today