EUVD-2026-87961
GHSA-9x87-2c36-ffjf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated smuggling with no UI; scope changes because the desync impacts backend systems beyond NetScaler, giving high confidentiality/integrity on downstream traffic and no availability effect.
Primary rating from Vendor (NetScaler).
CVSS VectorVendor: NetScaler
Lifecycle Timeline
4DescriptionCVE.org
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
Articles & Coverage 1
AnalysisAI
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers to send crafted requests that NetScaler and the protected back-end server parse differently, desynchronizing the HTTP connection so that follow-on requests are misrouted, poisoned, or injected into other users' traffic; the CVSS 9.3 score reflects high integrity and scope-changed impact on back-end traffic rather than compromise of the appliance itself (VC:N/VA:N, SC:H/SI:H). Affected are ADC builds before 14.1-73.37, before 13.1-64.23 and before 13.1-37.279 (NDcPP) plus their FIPS variants, and Gateway before 14.1-73.37 FIPS and before 13.1-64.23, per vendor advisory CTX697096. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation (PR:N/UI:N/AC:L) against affected Citrix NetScaler ADC or NetScaler Gateway appliances that proxy HTTP traffic to backend servers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not merely a high-CVSS-but-low-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches exist: upgrade NetScaler ADC to 14.1-73.37, 13.1-64.23, 13.1-37.279 (NDcPP), or the corresponding 14.1-73.37 FIPS build; upgrade NetScaler Gateway to 14.1-73.37 FIPS or 13.1-64.23, following Citrix advisory CTX697096 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096) for build-specific prerequisites and upgrade order. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the c
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding F
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway applia
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos An
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredict
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CV
Memory overflow in Citrix NetScaler ADC and NetScaler Gateway running versions prior to 14.1-73.37 or 13.1-64.23 (and th
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today