Warning: Critical HTTP request/response smuggling in Citrix Netscaler ADC & Gateway & FIPS, Patch Immediately!

Citrix and the Centre for Cybersecurity Belgium have published an advisory for CVE-2026-88773, a critical HTTP request/response smuggling vulnerability in Citrix NetScaler ADC and NetScaler Gateway (multiple affected versions). The flaw allows unauthenticated remote attackers to bypass security controls and view or modify restricted data; it is rated CVSS v4.0 9.3. A public proof-of-concept exists, and authorities recommend urgent patching and enhanced monitoring, although no active exploitation was observed as of 2026-10-06.