Citrix NetScaler ADC and Gateway contain a flaw that misinterprets HTTP URL-based expressions in feature-policy rules, allowing requests that should be denied to be processed as allowed. The defect creates a logic error that can enable unauthorized traffic to reach resources that were intended to be protected. The likely impact is the potential exposure of confidential data or unauthorized actions if the policy controls a critical service.

The flaw affects Citrix NetScaler ADC firmware versions prior to 14.1-73.37 and prior to 13.1-64.23, including the corresponding FIPS and NDcPP builds that are earlier than 14.1-73.37 FIPS and 13.1-37.279 FIPS/NDcPP. It also impacts Citrix NetScaler Gateway releases before 14.1-73.37 and before 13.1-64.23. All these versions lack the patch that corrects the misinterpretation of URL-based expressions in feature-policy processing.

The CVSS score of 7.0 indicates high severity while the EPSS score of less than 1% points to a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send a specially crafted HTTP request that manipulates the URL-based policy expression to trigger the bypass. Although exploitation is not trivial, environments that depend on feature-policy for critical controls should treat this as a high-risk issue.