Vulnerability in Citrix NetScaler ADC

[ Why it matters ]Priority signals

• Critical severity: CVSS 10.0
• Urgent advisory from CERT-EU, NCSC-NL

[ Description ]Official description

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

[ Fixes ]Fixes and patches

• Security bulletin: Citrix CTX697096Vendor patch or bulletin · CERT-FR · support.citrix.com/support-home/kbsearch/article, cited by CERT-FR CERTFR-2026-AVI-1235

[ Advisories ]Government CERT advisories

• CERT-FR28 Sep 2026CERTFR-2026-AVI-1235

  Multiple vulnerabilities in Citrix NetScaler ADC and Gateway Translated from French

  Multiple vulnerabilities have been discovered in Citrix NetScaler ADC and Gateway. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a security policy bypass. Citrix…

  CVE-2026-88777CVE-2026-88776CVE-2026-88771+5 more CVEs
• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3587

  Citrix NetScaler ADC and Citrix NetScaler Gateway: Multiple vulnerabilities Translated from German

  CVE-2026-88771CVE-2026-88778CVE-2026-88772+5 more CVEs
• CERT-EU27 Sep 2026CERT-EU 2026-014

  Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

  On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code…

  CriticalCVE-2026-88771CVE-2026-88772CVE-2026-88773+5 more CVEs
• NCSC-NL27 Sep 2026NCSC-2026-0394

  Vulnerabilities fixed in NetScaler ADC and NetScaler Gateway Translated from Dutch

  Probability/damage H/HCVE-2026-88771CVE-2026-88772CVE-2026-88773+5 more CVEs

[ References ]References

• support.citrix.com/support-home/kbsearch/articleVendor Advisory