CVE-2026-88773 is an HTTP Request/Response smuggling vulnerability in Citrix NetScaler ADC and Gateway products. It arises from inconsistent interpretation of HTTP requests, potentially allowing an attacker to manipulate HTTP traffic. The affected versions include ADC versions prior to 14.1-73.37 and 13.1-64.23, including FIPS and NDcPP variants, and Gateway versions prior to 14.1-73.37 FIPS and 13.1-64.23. The CVSS 4.0 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, but high impact on confidentiality, integrity, and availability with scope and security impact high. No vendor advisory or patch links were provided in the input data.

Successful exploitation could allow attackers to smuggle HTTP requests or responses, potentially bypassing security controls, interfering with web traffic processing, or causing unauthorized actions. The vulnerability affects confidentiality, integrity, and availability with high severity. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The input data does not include explicit patch or mitigation information. Users should monitor Citrix advisories for updates and apply official fixes once available.