CVE-2026-88773

EUVD-2026-87961
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 87.85%
Affected Products (NVD)
VendorProductVersion
citrixnetscaler_application_delivery_controller
13.1 ≤
𝑥
< 13.1-64.23
citrixnetscaler_application_delivery_controller
13.1 ≤
𝑥
< 13.1.37.279
citrixnetscaler_application_delivery_controller
14.1 ≤
𝑥
< 14.1-73.37
citrixnetscaler_application_delivery_controller
14.1-66.68 ≤
𝑥
≤ 14.1-73.37
citrixnetscaler_gateway
13.1 ≤
𝑥
< 13.1-64.23
citrixnetscaler_gateway
14.1 ≤
𝑥
< 14.1-73.37
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096