28 September 2026
Reference: CVE-2026-88773
1. What is being reported?
Researchers have discovered a vulnerability called 'HTTP Request/Response smuggling' in certain versions of Citrix NetScaler ADC and Gateway. This flaw lets attackers send deceptive web requests that can bypass security controls and potentially run harmful code on the device.
2. What this means in plain English
If your organisation uses affected Citrix NetScaler devices, attackers could exploit this flaw to access your network, steal data, or disrupt services. This risk is serious because it can be done remotely without needing physical access.
3. Could this affect a small business?
Small businesses or charities using Citrix NetScaler ADC or Gateway devices with the affected software versions could be at risk. Those not using these specific Citrix products or running updated versions are likely not affected.
4. What to do now
- Check if your organisation uses Citrix NetScaler ADC or Gateway devices.
- Ask your IT provider or software supplier if your devices are running the vulnerable versions.
- Apply any available software updates or patches from Citrix immediately.
- Monitor your network for unusual activity and report any concerns to your IT support.
5. Ask your IT provider
Can you confirm whether our Citrix NetScaler ADC or Gateway devices are affected by CVE-2026-88773, and have the necessary patches been applied?
6. Bottom line
If you use Citrix NetScaler devices, act quickly to update them and protect your organisation from this serious security threat.
Information based on CISA KEV, NVD, and reputable security reports.