This vulnerability in Citrix NetScaler ADC and Gateway arises from improper usage of HTTP URL based expressions, leading to a feature policy bypass. Affected versions include ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. The CVSS 4.0 vector indicates the vulnerability can be exploited remotely without user interaction but requires partial attack prerequisites. The flaw could allow an attacker to bypass configured feature policies, potentially impacting security controls.

Successful exploitation could allow an unauthenticated attacker to bypass feature policies on affected Citrix NetScaler ADC and Gateway devices. This may lead to unauthorized access or actions that are normally restricted by these policies. The vulnerability has a high severity rating with a CVSS score of 7.0, reflecting significant security impact but no direct evidence of active exploitation in the wild.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, review and tighten feature policy configurations and monitor for unusual activity related to HTTP URL expressions.