CVE-2026-88773
HTTP Request Smuggling
Updated
- CVSS 4.0
- 9.3 CRITICAL
- EPSS
- 3.1% (88th pct)
- CISA KEV
- Not listed
- Published
- 2026-09-27
- Weakness
- CWE-444
- CISA alert
- 2026-09-27
CISA Alert
Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
Key Findings
as of 2026-11-12- Its current EPSS score (3.1%) is higher than that of 12% of CISA KEV entries.
Severity
CVSS 4.0 · CNA · CVSS-B9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:NOpen in CVSS calculator SSVC · CISA-ADP
Exploitationnone
Automatableyes
Technical impactpartial
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrix NetScaler | Citrix NetScaler ADC | 0 to <14.1-73.37 0 to <13.1-64.23 0 to <14.1-73.37 FIPS 0 to <13.1-37.279 and NDcPP |
| Citrix NetScaler | Citrix NetScaler Gateway | 0 to <14.1-73.37 FIPS 0 to <13.1-64.23 |
References
1 linksRecord Details
- Published
- 2026-09-27
- Last updated
- 2026-09-29
- Assigner (CNA)
- NetScaler
- Credited to
- -
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.