NetScaler ADC and Gateway hit by critical HTTP request smuggling flaw

The September 2026 NetScaler update fixes CVE-2026-88773 (CVSS 9.3), an HTTP request smuggling flaw that only requires HTTP to be enabled. Two other bugs, CVE-2026-88771 and CVE-2026-88772 (both 9.5), have already been exploited in the wild. Fixed builds include 14.1-73.37 and 13.1-64.23.

• CVE-2026-88773: HTTP request smuggling, CVSS 9.3, no authentication needed
• CVE-2026-88771 and CVE-2026-88772 (9.5) already exploited in the wild
• Fixes: 14.1-73.37, 13.1-64.23, FIPS 13.1-37.279
• ZoomEye: about 239,300 internet-exposed NetScaler instances