VYPR
← All advisories
Critical severity10.0NVD Advisory· Published Sep 27, 2026· Updated Sep 29, 2026

CVE-2026-88773

CVE-2026-88773

Description

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

Affected products

6
  • Citrix Systems/Netscaler Application Delivery Controller3 versions
    cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*+ 2 more
    • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*range: >=13.1,<13.1-64.23
    • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*range: >=13.1,<13.1.37.279
    • cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*range: >=13.1,<13.1.37.279
  • Citrix Systems/Access Gateway
    cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
    Range: >=13.1,<13.1-64.23
  • Citrix Systems/NetScaler ADCllm-fuzzy
    Range: <14.1-73.37, <13.1-64.23, <14.1-73.37 FIPS, <13.1-37.279 NDcPP
  • Citrix Systems/NetScaler Gatewayllm-fuzzy
    Range: <14.1-73.37 FIPS, <13.1-64.23

Patches

Vulnerability mechanics

References

1

News mentions

10