CVE-2026-88773

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

CVSS

9.3

EPSS

—

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

PUBLISHED

Coverage

• ● Actively exploitedCritical 70CISA advisories & alerts◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards27 Sept, 12:00

  Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

  CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778. CISA has added CVE-2026-88771…

  ↗cisa.gov/news-events/alerts/2026/09/27/critical…(opens the publisher's site in a new tab)

What we observed