Search/CVE-2026-88773
● CVE — Critical

CVE-2026-88773

VendorcitrixProductnetscaler application delivery controller, netscaler gatewayDiscoveredSep 27, 2026UpdatedSep 29, 2026

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

View graph Watch Export
CVSS v3.1
10 CRITICAL
EPSS
0.36%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
6
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Connections
13 relationships
Timeline
disclosure → media coverage
Sep 27, 2026
Disclosure — published as a CVE record.
Sep 27, 2026
cert.europa.eu reports: 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
Sep 28, 2026
theregister.com reports: Certainties in life: Death, taxes, and critical Citrix vulns under attack
Sep 28, 2026
infosecurity-magazine.com reports: Citrix Patches Critical Zero Days Under Active Exploitation
Sep 28, 2026
ncsc.gov.uk reports: Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
Sep 29, 2026
atmarkit.itmedia.co.jp reports: 「パッチを当てても安心できない」　Citrix NetScalerゼロデイ、CISAが異例の対応を要求
Sep 30, 2026
advisories.ncsc.nl reports: NCSC-2026-0394 [1.01] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway
Public PoC (1)
github.com/Scyrix-LLC/CVE-2026-88773
Unverified third-party code — review before executing.