CVE-2026-88773: Citrix NetScaler ADC HTTP Request Smuggling

CVE-2026-88773 Overview

CVE-2026-88773 is an HTTP Request Smuggling vulnerability affecting Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway. The flaw stems from inconsistent interpretation of HTTP requests between frontend and backend components [CWE-444]. A remote, unauthenticated attacker can exploit this issue over the network without user interaction. Successful exploitation enables request smuggling attacks that can bypass security controls, poison caches, and compromise the integrity of upstream systems. Citrix published the issue in advisory CTX697096 and released fixed builds across multiple release trains.

Critical Impact
Unauthenticated network attackers can smuggle crafted HTTP requests through NetScaler ADC and Gateway to bypass security controls and target backend services.

Affected Products

Citrix NetScaler ADC versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 (FIPS and NDcPP)
Citrix NetScaler Gateway versions before 14.1-73.37
Citrix NetScaler Gateway FIPS versions before 13.1-64.23

Discovery Timeline

2026-09-27 - CVE-2026-88773 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-88773

Vulnerability Analysis

The vulnerability is classified under [CWE-444] Inconsistent Interpretation of HTTP Requests. Request smuggling occurs when two HTTP processors in a request chain disagree about where one request ends and the next begins. NetScaler ADC and Gateway act as frontend proxies for backend web applications. When the device parses Content-Length and Transfer-Encoding headers differently than the origin server, an attacker can inject a second request hidden inside the body of the first.

The smuggled request bypasses frontend security policies, including Web Application Firewall (WAF) inspection and authentication enforcement. Downstream servers process the hidden request with the trust context of the proxy, which enables session hijacking, cache poisoning, credential theft, and request routing manipulation.

Root Cause

The root cause is divergent HTTP message framing between NetScaler and backend services. Ambiguity in request parsing — such as conflicting length headers, non-standard chunked encoding, or malformed terminators — allows an attacker to construct a request that the proxy interprets as a single message while the backend interprets as two.

Attack Vector

Exploitation requires network access to a vulnerable NetScaler ADC or Gateway endpoint. The attacker sends a specifically crafted HTTP request containing conflicting framing headers. No authentication or user interaction is required. The vulnerability impacts the integrity of both the vulnerable component and downstream systems in scope.

No public proof-of-concept code is available at this time. See the Citrix Support Article CTX697096 for vendor technical details.

Detection Methods for CVE-2026-88773

Indicators of Compromise

HTTP requests to NetScaler endpoints containing both Content-Length and Transfer-Encoding: chunked headers in the same message
Unexpected responses to pipelined requests, including responses that correspond to a different client's session
Backend web server logs showing requests with no matching NetScaler access-log entry
Anomalous spikes in 400-series responses from backend services behind NetScaler

Detection Strategies

Deploy inline inspection that normalizes HTTP framing and rejects requests with conflicting Content-Length and Transfer-Encoding headers
Correlate frontend proxy access logs with backend server logs to detect request count mismatches
Monitor NetScaler management interfaces for unauthenticated requests containing suspicious header combinations or oversized chunk extensions

Monitoring Recommendations

Enable verbose HTTP logging on NetScaler ADC and forward logs to a centralized analytics platform for correlation
Alert on requests that produce more backend responses than frontend requests over a given interval
Track unexpected authentication events on backend applications originating from the NetScaler source IP range

How to Mitigate CVE-2026-88773

Immediate Actions Required

Inventory all NetScaler ADC and Gateway appliances and identify builds older than the fixed versions listed in CTX697096
Upgrade affected appliances to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 (FIPS and NDcPP) as applicable
Restrict management interface exposure to trusted administrative networks only
Review backend web server logs for signs of smuggled requests since the appliance was deployed

Patch Information

Citrix has released fixed builds across supported release trains. Administrators should consult the Citrix Support Article CTX697096 for the complete list of fixed versions and upgrade guidance. There are no vendor-provided workarounds; patching is the required remediation path.

Workarounds

No official workaround is provided by Citrix; upgrading to a fixed build is required
As a compensating control, place a strict HTTP-normalizing proxy or WAF in front of NetScaler to reject ambiguous requests until patching completes
Disable HTTP connection reuse and keep-alive on backend connections where feasible to limit smuggling impact

bash

# Verify the running NetScaler build and confirm it meets the fixed version
show ns version

# Example upgrade preparation (consult CTX697096 before executing)
shell
cd /var/nsinstall
# Transfer the fixed build package, then run the installer per vendor instructions