CVE-2026-88773 is a critical (CVSS 10.0) HTTP request smuggling flaw in Citrix NetScaler ADC and NetScaler Gateway. The two components can read the same request in different ways, with a scope change. Upgrade to 14.1-73.37 or 13.1-64.23 or later, and read bulletin CTX697096.
What's affected
The record lists these affected versions:
- NetScaler ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 FIPS and NDcPP
- NetScaler Gateway: before 14.1-73.37 and before 13.1-64.23
The Citrix security bulletin CTX697096 covers this CVE together with several siblings, from CVE-2026-88771 to CVE-2026-88778, and could not be loaded when this guide was written. Read it for the full table, including any end of life builds.
The CVSS vector in the record shows a changed scope, high confidentiality and integrity impact, and no privileges or user interaction needed. That is how it reaches a score of 10.0.
How to check if you're exposed
On the appliance, sign in over SSH and read the build:
show version
Compare it with the fixed builds above for your release train. Then find out how the appliance is used: as a load balancer, as a gateway, or both. The bulletin lists which configurations are affected by which CVE, so match yours against it. Internet-facing appliances come first.
What to do now
- Read bulletin CTX697096 and list which of its CVEs apply to your configuration.
- Upgrade to 14.1-73.37 or 13.1-64.23 or later, or the fixed FIPS and NDcPP build for your line.
- Do the internet-facing appliances first, then internal ones.
- Save the configuration before upgrading, and for high availability pairs upgrade one node at a time.
- Review appliance logs and unexpected restarts from before the upgrade.
- Consider placing a web application firewall or request normalization in front, as a temporary layer, while you schedule the upgrade.
Edge appliances are a poor place to delay. They sit at the boundary, they see all inbound traffic, and bugs in them are attractive to attackers. If your change process takes weeks, ask for an emergency path for the internet-facing nodes.
Plan for rollback too. Keep the previous image and configuration backup available, and test authentication flows, certificates and any custom policies after the upgrade.
Why it matters
The weakness is CWE-444 (inconsistent interpretation of HTTP requests), usually called HTTP request smuggling. A front-end component and a back-end component disagree on where one request ends and the next begins. An attacker can use that disagreement to hide a request inside another, so that controls applied to the first do not apply to the second.
For a gateway that fronts authentication and many applications, that mismatch can be serious, which explains the score. The bulletin and record do not give exploitation detail beyond that, and this guide does not add any.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Try it yourself
NetScaler bulletins list many CVEs together. A watch on your product list turns a bulletin like this into an alert with an owner.
Click through it at your own pace, or open it full screen.
Quick check
Which builds are fixed?
NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23 or later, plus the fixed FIPS and NDcPP build for your line. Confirm in bulletin CTX697096.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
