CVE-2026-88773

Citrix NetScaler ADC and Gateway suffer from HTTP request/response smuggling allowing attackers to bypass security controls and execute arbitrary code.

The HTTP request/response smuggling vulnerability in Citrix NetScaler ADC and Gateway allows attackers to manipulate HTTP requests, bypassing security filters and potentially executing arbitrary code. DIB organizations must ensure their Citrix infrastructure is patched to versions 14.1-73.37 or later, as this flaw could lead to unauthorized access and data breaches. Failure to patch exposes systems to exploitation in the wild, violating CMMC/NIST 800-171 requirements for timely vulnerability management.

Shame score — A critical CVSS 10.0 vulnerability in widely deployed Citrix load balancers allows remote code execution, indicating severe negligence in patch management and security design.