CVE-2026-88773
Received Received - Intake

HTTP Request Smuggling in Citrix NetScaler ADC and Gateway

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: NetScaler

Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-88773
EUVD
EUVD-2026-87961

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
citrix netscaler_adc to 13.1-37.279 (exc)
citrix netscaler_gateway to 13.1-64.23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an HTTP request/response smuggling issue in Citrix NetScaler ADC and Gateway. It allows attackers to send specially crafted HTTP requests that are interpreted inconsistently by different components, potentially leading to unauthorized access or data manipulation.

Impact Analysis

An attacker could exploit this to bypass security controls, access sensitive data, or disrupt services. It may allow unauthorized actions on the affected systems, leading to data breaches or service outages.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations and penalties if exploited.

Mitigation Strategies

Update Citrix NetScaler ADC and Gateway to the latest versions specified in the advisory: ADC before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 and NDcPP; Gateway before 14.1-73.37 FIPS and 13.1-64.23.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88773. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart