CVE-2026-88773

NetScaler ADC and Gateway are devices many businesses use to manage and secure their web traffic, kind of like a mail sorting room that decides where incoming requests go. This flaw lets an attacker smuggle a hidden, malicious request inside a normal-looking one, tricking the device into misdelivering or exposing information meant for someone else. Because no login is needed to try this, it's a serious open door if the device faces the internet.

This matters to you if you run Citrix NetScaler ADC or NetScaler Gateway to manage or secure your business's web traffic or remote access. All editions and models using the vulnerable versions are affected, regardless of specific configuration. This is a real risk whenever the device is reachable from the internet, which is the normal setup for these products.

Attackers are already being reported as actively exploiting this flaw, not just experimenting with it, so this is an immediate, real-world threat rather than a theoretical one. Combined with the fact that no login is required to exploit it, this puts any internet-facing, unpatched device at serious risk right now. Treat this as urgent and act without delay.

1. Inventory all NetScaler ADC and NetScaler Gateway instances and record their exact build numbers. 2. Compare against the fixed versions: 13.1-64.23 (ADC/Gateway), 14.1-73.37 (ADC), 14.1-73.37 FIPS (ADC/Gateway), and 13.1-37.279 and NDcPP (ADC) — any build prior to the applicable fixed release for your branch is vulnerable. 3. Prioritize upgrading internet-facing appliances first, following Citrix's published remediation guidance at CTX697096. 4. Review upgrade notes for your specific branch (standard vs FIPS vs NDcPP builds use different fixed releases) to avoid compatibility issues during the upgrade. 5. If immediate upgrade isn't possible, restrict management/administrative access and review WAF or front-end proxy configurations for request normalization as a stopgap — this is not a substitute for patching. 6. This CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog, so there is no federal remediation deadline, but treat the news reports of active exploitation as sufficient reason to patch on an emergency timeline. 7. After patching, monitor NetScaler logs for anomalous or malformed HTTP traffic and review access logs for signs of prior compromise.

CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects an unauthenticated, network-exploitable, low-complexity vulnerability with scope change and high confidentiality/integrity impact but no availability impact. The weakness (CWE-444, inconsistent interpretation of HTTP requests) enables request/response smuggling between front-end and back-end components. No public exploit code has been identified and the CVE is not currently in CISA's KEV catalog, but press reporting indicates active exploitation in the wild, which should be treated as confirmed rather than relying on the low (0.4%) EPSS prediction. Exploit maturity is therefore assessed as actively exploited despite the absence of public PoC code, warranting emergency patching to the fixed builds noted in the Citrix advisory CTX697096.