I’M UNDER A CYBER ATTACK

Alert

Alert 2026-136 Critical flaw in Citrix NetScaler ADC and Gateway allows HTTP request smuggling

Affected product(s): 

ProductAffected versionsFixed version
NetScaler ADC and NetScaler Gateway 14.1Prior to 14.1-73.3714.1-73.37
NetScaler ADC and NetScaler Gateway 13.1Prior to 13.1-64.2313.1-64.23
NetScaler ADC 14.1-FIPSPrior to 14.1-73.37 FIPS14.1-73.37 FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPPPrior to 13.1-37.27913.1-37.279

Only affects customer-managed deployments, including NetScaler instances of Secure Private Access Hybrid.

Description

A critical-severity vulnerability (CVSSv4 9.3 – CRITICAL) has been disclosed in Citrix NetScaler ADC and NetScaler Gateway that allows an unauthenticated remote attacker to perform HTTP request smuggling. The vulnerability has been assigned the identifier CVE-2026-88773 and is of the Inconsistent Interpretation of HTTP Requests type (CWE-444).

Appliances with HTTP or SSL load balancing (LB), content switching (CS), VPN (Gateway), or authentication (AAA) virtual servers are affected. The management interface is not affected. The vendor did not publish technical details; according to its CVSS vector, the impact affects the integrity of the requests processed by the appliance and the confidentiality and integrity of the systems behind it. The vulnerability does not allow code execution on the appliance.

CVE-2026-88773 is part of bulletin CTX697096 dated 27/09/2026, the same bulletin that fixed CVE-2026-88771 and CVE-2026-88772, which were actively exploited and addressed in Alert 2026-110. The fixed versions are the same, so appliances already updated to address those vulnerabilities are also protected against this one.

Researchers published a detailed technical analysis on 02/10/2026 and, on 31/10/2026 at 22:58 (PYT), a functional proof of concept. No active exploitation is known, and CVE-2026-88773 is not listed in the Known Exploited Vulnerabilities (KEV) catalog of the U.S. cybersecurity agency. In the same bulletin, CVE-2026-88771 and CVE-2026-88772 have been listed in the KEV since 27/09/2026, as has CVE-2026-88779, another NetScaler vulnerability, since 04/10/2026.

Mitigation

There is no temporary mitigation; the only solution is to update.

Detection

To identify affected appliances, it is recommended to:

  • Search ns.conf for HTTP or SSL virtual servers: add lb vserver <name> <HTTP|SSL>, add cs vserver <name> <HTTP|SSL>, add vpn vserver <name> <HTTP|SSL>, or add authentication vserver <name> <HTTP|SSL>.
  • Use NetScaler Console (Security Advisory > CVE Detection), which includes CVE-2026-88773. Console does not assess unsupported versions and may incorrectly flag 13.1-64.23 as vulnerable until its next Security Advisory update.

Solution

The solution is to update to the fixed version of each branch or a later version:

  • NetScaler ADC and Gateway 14.1: 14.1-73.37.
  • NetScaler ADC and Gateway 13.1: 13.1-64.23. If cyclic reboots occur during the update, 13.1-64.24 is recommended.
  • NetScaler ADC 14.1-FIPS: 14.1-73.37 FIPS.
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP: 13.1-37.279.

The versions released on 27/10/2026 for PHP2Shell (Alert 2026-117), 14.1-73.49, 13.1-64.32, 14.1-73.49 FIPS, and 13.1-37.286 FIPS/NDcPP, are later than the fixed versions and therefore also cover this vulnerability.

Versions 12.1 and 13.0 do not receive patches, so migration to a supported version is recommended.

For information on how to update, visit the following link:

https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html

Additional information: