All vulnerabilities
CVE-2026-88773

ADC: HTTP Request Smuggling

Citrix NetScaler ADCNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationPublic exploit codeExploit module, 27 Sep 2026. Not in the KEV catalogMetasploit
Exploit odds (EPSS)1.30%Chance of exploitation activity in the next 30 days, higher than 70% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in14.1-73.37Also 13.1-64.23, 14.1-73.37 FIPS and 1 moreCVE List
Published27 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 27 Sep 2026Exploit code publicMetasploit
  2. 27 Sep 2026, 16:20 UTCPublishedCVE List
  3. 28 Sep 2026, 10:55 UTCFirst reportwatchTowr Labs

Public exploit code and templates 1

  • Exploit moduleCitrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771) 27 Sep 2026Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

Text from CVE List

Affected versions 6

  • ADCaffected: all versions before 14.1-73.37CVE List
  • ADCaffected: all versions before 13.1-64.23CVE List
  • ADCaffected: all versions before 14.1-73.37 FIPSCVE List
  • ADCaffected: all versions before 13.1-37.279 and NDcPPCVE List
  • Gatewayaffected: all versions before 14.1-73.37 FIPSCVE List
  • Gatewayaffected: all versions before 13.1-64.23CVE List

References 1