Citrix NetScaler ADC e Citrix NetScaler Gateway · Public exploit code

Public HTTP smuggling PoC hits Citrix NetScaler ADC and Gateway

Nov 02, 2026 · 1 min read

An inconsistent HTTP request interpretation flaw (request smuggling) in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88773, now has a public proof of concept. Affected builds include ADC before 14.1-73.37 and 13.1-64.23, including FIPS and NDcPP, and Gateway before 14.1-73.37 FIPS and 13.1-64.23. Administrators should update to the fixed builds.

By HIFY Radar newsroom Updated 11/02/2026 04:58 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codePatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A public proof of concept was released for CVE-2026-88773 in Citrix NetScaler ADC and NetScaler Gateway. The defect makes the appliance interpret HTTP requests inconsistently between systems (HTTP request smuggling). Older builds of both products are affected.

Why it matters

ADC and Gateway sit at the network edge, handling web traffic and remote access. This class of flaw can misroute requests between client and server, risking unauthorized access to data and user sessions. With the PoC public, risk rises for anyone still unpatched.

What to do

Update NetScaler ADC to 14.1-73.37, 13.1-64.23 or later builds, including FIPS and NDcPP, and Gateway per the Citrix list. Confirm the version running in production today.

For the technical team

CVE: CVE-2026-88773
Affected: Citrix NetScaler ADC e Citrix NetScaler Gateway · ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, before 13.1-37.279 and NDcPP. Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
Exploitation: Public PoC/exploit, reported by @ptdbugs (dbugs). The source cites no exploitation in the wild and no KEV listing.
Fix: Update to 14.1-73.37 or 13.1-64.23 and FIPS equivalents (14.1-73.37 FIPS). The source cites no alternative mitigations.
Vector: NetScaler ADC and NetScaler Gateway. Inconsistent interpretation of HTTP requests (HTTP request/response smuggling). Appliances processing HTTP traffic; specific exploitation condition not detailed in the source.
More details: Identifiers: CVE-2026-88773 and PT ID PT-2026-99552. Disclosed via dbugs (@ptdbugs). The source gives no attack chain, discoverer, CVSS score or dates.