{"id":12352,"date":"2026-11-02T07:52:13","date_gmt":"2026-11-02T13:52:13","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-136-critical-vulnerability-in-citrix-netscaler-adc-and-gateway-allows-http-request-smuggling\/"},"modified":"2026-11-02T07:54:58","modified_gmt":"2026-11-02T13:54:58","slug":"alert-2026-136-critical-flaw-in-citrix-netscaler-adc-and-gateway-allows-http-request-smuggling","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-136-critical-flaw-in-citrix-netscaler-adc-and-gateway-allows-http-request-smuggling\/","title":{"rendered":"Alert 2026-136 Critical flaw in Citrix NetScaler ADC and Gateway allows HTTP request smuggling"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
NetScaler ADC and NetScaler Gateway 14.1<\/strong><\/td>Prior to 14.1-73.37<\/td>14.1-73.37<\/td><\/tr>
NetScaler ADC and NetScaler Gateway 13.1<\/strong><\/td>Prior to 13.1-64.23<\/td>13.1-64.23<\/td><\/tr>
NetScaler ADC 14.1-FIPS<\/strong><\/td>Prior to 14.1-73.37 FIPS<\/td>14.1-73.37 FIPS<\/td><\/tr>
NetScaler ADC 13.1-FIPS and 13.1-NDcPP<\/strong><\/td>Prior to 13.1-37.279<\/td>13.1-37.279<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Only affects customer-managed deployments, including NetScaler instances of Secure Private Access Hybrid.<\/p>\n\n

Description<\/h2>\n\n

A critical-severity vulnerability (CVSSv4 9.3 – CRITICAL) has been disclosed in Citrix NetScaler ADC and NetScaler Gateway that allows an unauthenticated remote attacker to perform HTTP request smuggling. The vulnerability has been assigned the identifier CVE-2026-88773 and is of the Inconsistent Interpretation of HTTP Requests type (CWE-444).<\/p>\n\n

Appliances with HTTP or SSL load balancing (LB), content switching (CS), VPN (Gateway), or authentication (AAA) virtual servers are affected. The management interface is not affected. The vendor did not publish technical details; according to its CVSS vector, the impact affects the integrity of the requests processed by the appliance and the confidentiality and integrity of the systems behind it. The vulnerability does not allow code execution on the appliance.<\/p>\n\n

CVE-2026-88773 is part of bulletin CTX697096 dated 27\/09\/2026, the same bulletin that fixed CVE-2026-88771 and CVE-2026-88772, which were actively exploited and addressed in Alert 2026-110<\/a>. The fixed versions are the same, so appliances already updated to address those vulnerabilities are also protected against this one.<\/p>\n\n

Researchers published a detailed technical analysis on 02\/10\/2026 and, on 31\/10\/2026 at 22:58 (PYT), a functional proof of concept. No active exploitation is known, and CVE-2026-88773 is not listed in the Known Exploited Vulnerabilities (KEV) catalog of the U.S. cybersecurity agency. In the same bulletin, CVE-2026-88771 and CVE-2026-88772 have been listed in the KEV since 27\/09\/2026, as has CVE-2026-88779, another NetScaler vulnerability, since 04\/10\/2026.<\/p>\n\n

Mitigation<\/h2>\n\n

There is no temporary mitigation; the only solution is to update.<\/p>\n\n

Detection<\/h2>\n\n

To identify affected appliances, it is recommended to:<\/p>\n\n