CVE-2026-88773
Citrix NetScaler ADC
- Citrix NetScaler ADC
- Critical
- CVSS 9.3
- EPSS 3.36%
- Fixed version listed
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Citrix NetScaler ADC | before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1-37.279 and NDcPP | None listed |
| Citrix NetScaler Gateway | before 14.1-73.37 FIPS; before 13.1-64.23 | 14.1-73.37 FIPS |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v4.0, scored by NetScaler)
- EPSS
- 3.36% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 26, 2026)
- CISA's SSVC decision points
- Exploitation: none. Automatable: yes. Technical impact: partial. As of Sep 29, 2026.
- Weakness
- CWE-444: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')
- Vendor
- Citrix NetScaler, ADC
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.