What’s Vulnerable › Vulnerabilities
CVE-2026-88773: HTTP Request Smuggling
- Severity: critical (CVSS 10.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-27 · updated 2026-09-29
- Weakness: CWE-444
Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
Summary
CVE-2026-88773 is a critical (CVSS 10) HTTP request smuggling flaw caused by inconsistent interpretation of HTTP requests in Citrix NetScaler ADC and NetScaler Gateway. Successful exploitation could let attackers bypass security controls, poison caches, or hijack other users' requests. Affected versions include ADC before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 and NDcPP, and Gateway before 14.1-73.37 FIPS and 13.1-64.23. It is not in CISA KEV and SSVC reports no known exploitation, though EPSS estimates a 3.4% chance of exploitation within 30 days. Apply the fixed releases (13.1-64.23, 13.1.37.279, 14.1-73.37) as soon as possible.
تُعدّ CVE-2026-88773 ثغرة تهريب طلبات HTTP (HTTP Request Smuggling) حرجة بدرجة CVSS 10، سببها تفسير غير متسق لطلبات HTTP في Citrix NetScaler ADC وCitrix NetScaler Gateway. قد يسمح استغلالها للمهاجمين بتجاوز ضوابط الأمان أو تسميم ذاكرات التخزين المؤقت أو اختطاف طلبات مستخدمين آخرين. تشمل الإصدارات المتأثرة ADC قبل 14.1-73.37 و13.1-64.23 و14.1-73.37 FIPS و13.1-37.279 وNDcPP، وGateway قبل 14.1-73.37 FIPS و13.1-64.23. الثغرة ليست في CISA KEV ولا يشير SSVC إلى استغلال معروف، لكن EPSS يقدّر احتمال الاستغلال خلال 30 يوماً بنسبة 3.4%. يُنصح بتطبيق الإصدارات المُصلحة (13.1-64.23 و13.1.37.279 و14.1-73.37) في أقرب وقت.
Affected products
- Citrix NetScaler ADC: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
- Citrix Netscaler Application Delivery Controller Fips: from 13.1 before 13.1.37.279; from 14.1-66.68 through 14.1-73.37 — fixed in 13.1.37.279
- Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1.37.279 — fixed in 13.1.37.279
- Citrix NetScaler Gateway: from 13.1 before 13.1-64.23; from 14.1 before 14.1-73.37 — fixed in 13.1-64.23, 14.1-73.37
- NetScaler ADC: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1-37.279 and NDcPP — fixed in 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 and NDcPP
- NetScaler Gateway: before 14.1-73.37 FIPS; before 13.1-64.23 — fixed in 14.1-73.37 FIPS, 13.1-64.23
How to fix
Upgrade to a fixed version: Citrix NetScaler ADC 13.1-64.23, 14.1-73.37; Citrix Netscaler Application Delivery Controller Fips 13.1.37.279; Citrix Netscaler Application Delivery Controller Ndcpp 13.1.37.279; Citrix NetScaler Gateway 13.1-64.23, 14.1-73.37; NetScaler ADC 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 and NDcPP; NetScaler Gateway 14.1-73.37 FIPS, 13.1-64.23. Check the vendor advisory for mitigations.
In the news
- 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
- Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
- Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
References
Get alerted when CVE-2026-88773 or the next vulnerability affects your stack