Skip to content
Sign in
CVE-2026-887739.3CriticalCWE-444

CVE-2026-88773: HTTP Request Smuggling

Citrix NetScaler · ADC

Vendor fix available · Affected: Citrix NetScaler ADC · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public3 public GitHub repositories (unverified), listed by PoC-in-GitHub2 Oct
  5. Not established: not seen
3.1%probability of exploitation in the next 30 days
87th percentile
050100

Higher than 87% of scored CVEs

9.3CriticalCVSS 4.0
LowCrit.

DescriptionNVD

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

What changed

  1. PoC-in-GitHub lists 3 public GitHub repositories (unverified) PoC-in-GitHub

Coverage3 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: Infosecurity, 28 Sep.

Full timeline
Quiet for 6 weekslast report 28 Sep3 articles3 outlets
28 Sep · Infosecurity first22 Oct30 OctNow
  • Mon 28 Sep, 08:35 UTC. Infosecurity, first report. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws.
All coveragerunning total3Infosecurity1Rapid71NCSC129 Sep14 Oct29 OctNow
  • First report
  • Article
  • Official notice
  • Running total
Show as table
3 articles about CVE-2026-88773 from 3 outlets
Published (UTC)OutletHeadline
28 Sep 08:35InfosecurityCitrix NetScaler Zero Days Exploited in Attacks, Patch Now
28 Sep 12:07Rapid7Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks
28 Sep 13:21NCSCUK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws
  1. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws
    NCSC · official notice · mentions it in passing
  2. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks
    Rapid7 · mentions it in passing
  3. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now
    Infosecurity · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in