Citrix patches CVSS 10.0 request smuggling flaw in NetScaler ADC

Citrix published a 27 September 2026 bulletin covering eight CVEs in NetScaler ADC and Gateway. The headline flaw, CVE-2026-88773, scores CVSS 10.0 and is a CWE-444 request smuggling issue that lets an attacker inherit a victim's backend authentication. Fixed builds are 14.1-73.37 and 13.1-64.23.

• CVE-2026-88773: CVSS 10.0, CWE-444, vector with S:C crossing a scope boundary
• Two more CVEs rated 9.8 for memory overflow; others range from 7.2 to 8.1
• Affected: ADC and Gateway before 14.1-73.37 and 13.1-64.23, including FIPS and NDcPP
• A single upgrade remediates all eight vulnerabilities