MSRXMSRXSecurity
Vulnerabilities / CVE-2026-88773

CVE-2026-88773

Published 2026-09-27 · published (not yet in NVD)

CVE-2026-88773

HTTP Request Smuggling

9.3 CRITICAL
CVSS 4.0 · CNA
3.4%
chance of exploitation in the next 30 days (EPSS; higher than 88% of CVEs)

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

Scores

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:NCNA

Affected products

  • Citrix NetScaler ADC: < 14.1-73.37; < 13.1-64.23; < 14.1-73.37 FIPS; < 13.1-37.279 and NDcPP
  • Citrix NetScaler Gateway: < 14.1-73.37 FIPS; < 13.1-64.23

Weakness: CWE-444

1 references (advisories, patches, write-ups)

Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVECheck your dependenciesScan a website