Citrix NetScaler Policy Bypass via HTTP URL Expression

CVE-2026-88774 is a feature policy bypass vulnerability affecting Citrix NetScaler ADC and Gateway appliances through versions 14.1-73.37 and 13.1-64.23. The vulnerability stems from improper handling of HTTP URL-based expressions, allowing attackers to circumvent configured security policies that should restrict access to protected resources. This is particularly critical because NetScaler appliances serve as primary access control points for many organizations—sitting between users and internal applications. A successful exploit could allow unauthorized access to sensitive data, internal services, or administrative functions, making this a high-severity issue (CVSS 7.2) despite not yet being actively exploited in the wild.

While Casky.ai currently has zero mapped skills specifically indexed to this CVE, the underlying attack pattern aligns with policy enforcement bypass techniques that practitioners should monitor through behavioral analysis. Organizations using Casky would benefit from developing custom detection logic around HTTP request manipulation and expression evaluation anomalies—looking for suspicious URL patterns in access logs that attempt to bypass rewrite rules or policy expressions. Security teams should prioritize updating affected NetScaler instances to patched versions (14.1-73.37 or later, 13.1-64.23 or later) and implement compensating controls such as enhanced HTTP request validation at the WAF or proxy layer. As the threat landscape evolves and exploitation techniques emerge, Casky's skill library will expand to map detection patterns to relevant MITRE ATT&CK techniques, likely under categories such as T1190 (Exploit Public-Facing Application) or T1562 (Impair Defenses).