CVE-2026-88773Netscaler Gateway Vulnerability
HTTP Request Smuggling
Published Sep 27, 2026 · Updated Sep 29, 2026 · Also known as EUVD-2026-87961, GHSA-9x87-2c36-ffjf, TR-26-1195
Key Facts
Patch immediately- CVE-2026-88773 is a critical-severity vulnerability (CVSS 9.3 v4) affecting Netscaler Application Delivery Controller (Citrix), Netscaler Gateway (Citrix).
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 1.3% probability of exploitation in the next 30 days.
- Fixed versions are available, including Netscaler Application Delivery Controller 13.1-37.279 and NDcPP, Netscaler Application Delivery Controller 13.1-64.23, Netscaler Application Delivery Controller 14.1-73.37.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v4
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS (30-day exploit likelihood)
1.3%
Higher than 70.2% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
77/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
5
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-88773
- advisoryhttps://cert.europa.eu/publications/security-advisories/2026-014
- advisoryhttps://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html
- advisoryhttps://support.citrix.com/external/article/CTX697096
- advisoryhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
- advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
Affected Products
8 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Netscaler Application Delivery ControllerCitrix | See advisory | 13.1-64.23 |
| Netscaler GatewayCitrix | See advisory | 13.1-64.23 |
Patched Releases
Netscaler Application Delivery Controller
13.1-37.279 and NDcPP, 13.1-64.23, 14.1-73.37, 14.1-73.37 FIPS, 13.1.37.279
Netscaler Gateway
13.1-64.23, 14.1-73.37, 14.1-73.37 FIPS
Timeline
Publicly disclosed
Sep 27, 2026
Last updated
Sep 29, 2026
Weakness Type
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
References
- advisorynvd.nist.gov · CVE-2026-88773
- advisorycert.europa.eu · 2026-014
- advisorysupport.citrix.com · steps-to-take-if-netscaler-adc-is-suspec.html
- advisorysupport.citrix.com · CTX697096
- advisorysupport.citrix.com · article
FAQ
Common Questions.
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Affected: Netscaler Application Delivery Controller (Citrix); Netscaler Gateway (Citrix). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Netscaler Application Delivery Controller 13.1-37.279 and NDcPP, Netscaler Application Delivery Controller 13.1-64.23, Netscaler Application Delivery Controller 14.1-73.37.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-88773 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo