HTTP request smuggling on NetScaler ADC and Gateway (CVE-2026-88773)
HTTP request smuggling on NetScaler ADC and Gateway (CVE-2026-88773) Not every serious appliance bug is a memory corruption. In the September 2026 NetScaler release, CVE-2026-88773 is an HTTP request smuggling flaw rated 9.3 on CVSS v4. The precondition is simply that HTTP functionality is enabled on NetScaler ADC or Gateway, and neither authentication nor user interaction is required.…
CVE-2026-88773 is a serious HTTP request smuggling flaw affecting NetScaler ADC and Gateway appliances. This vulnerability allows an attacker to bypass access controls and potentially poison the connection of another user, even without authentication or user interaction. The vulnerability is triggered when HTTP functionality is enabled on the appliance.
The advisory classifies this as inconsistent interpretation of HTTP requests, which can lead to various attacks depending on the setup behind the NetScaler. For reverse proxy scenarios, smuggled requests may bypass access rules and reach internal endpoints. The vulnerability is rated 9.3 on CVSS v4 and has been confirmed exploited.
Citrix has released security updates to address this issue. NetScaler ADC and Gateway versions 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23 are affected. The NCSC recommends applying the updates without delay and preserving relevant logs and memory dumps for forensic analysis in case of prior compromise.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
