CVE intelligence

CVE-2026-88773

Citrix NetScaler HTTP request smuggling

Published Sep 27, 2026Sources checked Nov 11, 2026

10.0CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-88773 and is rated Critical severity with a CVSS score of 10.0. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

Public exploit: Cataloged public exploit.

Citrix: Citrix publishes fixed builds and configuration prerequisites (2026-09-27)
Citrix lists fixed releases for customer-managed NetScaler ADC and Gateway. Check HTTP and SSL virtual servers against the prerequisites in the Citrix bulletin.
Rapid7 Metasploit: Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771) (2026-10-23 00:44:03.604174+00)
Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

What to do next

Remediation and response

Upgrade to the fixed build for your branch: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 FIPS/NDcPP, or a later release listed by Citrix.
Check HTTP and SSL virtual servers against the prerequisites in the Citrix bulletin.

Citrix Security Bulletins guidance

Vendor revision: Oct 12, 2026

Vendor remediation details

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1 Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP NetScaler deployments impacted by CVE-2026-88778 should apply the TCP configuration change as mentioned in https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation

Vendor-listed releases

Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1
Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP

CISA KEVNot listedBased on the latest collected catalog

EPSS3.1%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-88773?

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

Source: NVD

Vendor context: Citrix lists fixed releases for customer-managed NetScaler ADC and Gateway. Check HTTP and SSL virtual servers against the prerequisites in the Citrix bulletin.
Citrix · Published Sep 27, 2026