Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Citrix NetScaler ADC and Gateway can mishandle web traffic

CVE-2026-88773 · published 22 days ago
Summary

Older versions of Citrix NetScaler ADC and NetScaler Gateway may treat incoming web requests differently, allowing a single request to be split and processed incorrectly. This can let an attacker bypass security controls or inject unintended commands. Upgrade to the latest software releases or apply the vendor's recommended patches to resolve the issue.

What to do
  • Update citrix netscaler gateway to version 14.1-73.37 FIPS or later.
  • Update citrix netscaler adc to version 14.1-73.37 or later.
Affected software
VendorProductAffected versions
citrix netscaler gateway < 14.1-73.37 FIPS
citrix netscaler adc < 14.1-73.37
citrix netscaler_application_delivery_controller >= 13.1, < 13.1-64.23
>= 13.1, < 13.1.37.279
>= 14.1, < 14.1-73.37
>= 14.1-66.68, <= 14.1-73.37
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
citrix netscaler_gateway >= 13.1, < 13.1-64.23
>= 14.1, < 14.1-73.37
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
Original advisory text
HTTP Request Smuggling
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-88773 · NVD
CVE-2026-88773 · MITRE
Track software like this
Free during beta