HTTP Request Smuggling Vulnerability in Citrix NetScaler ADC and Gateway
CVE-2026-88773

9.3CRITICAL

Key Information:

Vendor: Citrix Netscaler
Status: Adc; Gateway
Vendor: CVE Published:; 27 September 2026

🔔 Create Citrix Netscaler Vulnerability Alert

What is CVE-2026-88773?

An HTTP request smuggling vulnerability exists in Citrix NetScaler ADC and Gateway due to inconsistent handling of HTTP requests. This flaw can allow an attacker to exploit the application's behavior when processing requests, potentially leading to unauthorized access or data manipulation. The vulnerability affects several versions of both products, necessitating immediate attention for users operating under the specified versions to mitigate associated risks.

Affected Version(s)

ADC 0 < 14.1-73.37

ADC 0 < 13.1-64.23

ADC 0 < 14.1-73.37 FIPS

References

https://support.citrix.com/support-home/kbsearch/article?...

CVSS V4

Score:

9.3

Severity:

CRITICAL

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 27, 2026
Vulnerability Reserved
Sep 10, 2026

CVE-2026-88773 Data

JSON