CVE-2026-88773: 
Citrix ADC VPX vulnerability analysis and mitigation

CVE-2026-88773 is an HTTP Request Smuggling vulnerability (CWE-444) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, caused by inconsistent interpretation of HTTP requests. It was published on September 27, 2026, and affects NetScaler ADC versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 (NDcPP); and NetScaler Gateway versions before 14.1-73.37 FIPS and before 13.1-64.23. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 9.3 (Critical), and requires no authentication or user interaction to exploit (GitHub Advisory, Citrix Advisory).

The root cause is a 32-bit integer overflow in NetScaler's HTTP chunked-transfer-encoding parser (CWE-444). When processing a chunk-size field containing the 9-digit hex value 100000005, the parser accumulates digits into a 32-bit register via a shift-and-add loop (value <<= 4; value += digit) without overflow checking. After nine iterations, the top 4 bits are shifted off, wrapping 0x100000005 to 0x00000005 (decimal 5). NetScaler's only guard is a sign test that rejects values ≥ 0x80000000, so the wrapped value of 5 passes validation. NetScaler then considers the request complete after consuming 5 body bytes, queues the remaining bytes (e.g., a smuggled GET /SMUGGLED request) as a pipelined request on the same backend connection, and forwards the original chunked framing byte-for-byte to the backend — creating a request boundary desynchronization. Exploitation requires only the ability to send TCP traffic to a NetScaler HTTP virtual server; no authentication is needed (GitHub Advisory, PoC Repository).

Successful exploitation allows an unauthenticated network attacker to smuggle arbitrary HTTP requests through the NetScaler appliance to backend servers, bypassing security controls enforced by the ADC or Gateway. Depending on the backend HTTP parser behavior, the attacker can either execute a smuggled request on the backend (if the backend also truncates chunk sizes to 32 bits), enabling access to confidential data and unauthorized modification of sensitive information, or cause a denial-of-service via connection-pool exhaustion (if the backend parses the chunk size correctly and waits indefinitely for a 4 GB body). The changed-scope CVSS rating reflects that the impact extends beyond the NetScaler appliance itself to downstream backend systems, enabling potential lateral movement into internal infrastructure (GitHub Advisory, Citrix Advisory).

A public proof-of-concept exploit is available on GitHub (published October 2, 2026) with detailed step-by-step instructions, concrete HTTP payloads, and flow diagrams demonstrating exploitation against real NetScaler systems (PoC Repository). Feedly's exploit analysis rates the PoC confidence as high and confirms it is a real exploit. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation of CVE-2026-88773 specifically, though related CVEs in the same advisory batch (CVE-2026-88771, CVE-2026-88772) were actively exploited and added to CISA's Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.36% (28th percentile). The vulnerability is automatable and requires no authentication, making it a strong candidate for rapid weaponization (GitHub Advisory, Citrix Advisory).

1. Reconnaissance: Identify internet-facing Citrix NetScaler ADC or Gateway instances using tools like Shodan or Censys, targeting versions before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 NDcPP.
2. Craft the malicious HTTP request: Construct a POST request with Transfer-Encoding: chunked and a chunk-size field of 100000005 (a 9-digit hex value that overflows a 32-bit accumulator to 5):

POST /wrap HTTP/1.1\r\n
Host: poc\r\n
Transfer-Encoding: chunked\r\n
\r\n
100000005\r\n
AAAAA\r\n
0\r\n
\r\n
GET /SMUGGLED HTTP/1.1\r\nHost: poc\r\n\r\n

3. Trigger the integer wrap in NetScaler's parser: NetScaler's chunk-size accumulation loop (assembly at 0x20af5e0) processes 9 hex digits, causing 0x100000005 to wrap to 0x00000005. The sign-test guard passes the wrapped value as legitimate.
4. NetScaler declares request #1 complete: After consuming 5 body bytes (AAAAA) and the terminating 0-chunk, NetScaler holds the remaining 37 bytes (GET /SMUGGLED HTTP/1.1...) as a queued pipelined request.
5. NetScaler forwards verbatim framing to backend: The full 85-byte POST (including the original 100000005 chunk-size) is forwarded byte-for-byte to the backend server.
6. Backend desynchronization: If the backend parses chunk sizes correctly, it waits for a 4 GB body that never arrives, wedging the connection (DoS). If the backend also truncates to 32 bits, it processes the 5-byte body and then interprets the smuggled GET /SMUGGLED as a separate request, relaying the response to the attacker.
7. Chain further attacks: In the smuggle case, the attacker can use the smuggled request to access restricted backend resources, poison shared connection pools, or pivot to further exploitation of backend applications (PoC Repository).

• Network: Unusual HTTP POST requests to NetScaler virtual server endpoints containing a Transfer-Encoding: chunked header with a 9-digit hex chunk-size value (e.g., 100000005); unexpected outbound connections from backend servers to attacker-controlled IPs following NetScaler-proxied requests.
• Logs: NetScaler access logs showing POST requests with abnormally large or malformed chunk-size values; backend server logs recording unexpected or duplicate HTTP requests (e.g., GET /SMUGGLED) that were not initiated by legitimate clients; connection-pool exhaustion events or hung connections in backend server logs.
• Network: Backend servers receiving HTTP requests with Transfer-Encoding: chunked bodies containing chunk-size values that do not match the actual body length; connections from NetScaler to backend that remain open indefinitely without completing a response cycle.
• Process/Application: Backend application errors or anomalous responses triggered by requests that appear to originate from other users' sessions, indicating request boundary confusion; unexpected HTTP 400/500 errors on backend servers correlated with NetScaler proxy traffic (PoC Repository, GitHub Advisory).

Citrix has released patched versions addressing CVE-2026-88773. Administrators should upgrade to the following fixed versions immediately:

• NetScaler ADC: 14.1-73.37 or later; 13.1-64.23 or later; 14.1-73.37 FIPS or later; 13.1-37.279 (NDcPP) or later
• NetScaler Gateway: 14.1-73.37 FIPS or later; 13.1-64.23 or later

While patches are being deployed, consider implementing additional network segmentation to limit exposure of NetScaler appliances, and review HTTP request handling policies. Prioritize patching internet-facing instances. No specific configuration-based workaround has been published by Citrix for this vulnerability (Citrix Advisory, GitHub Advisory).

The broader batch of Citrix NetScaler vulnerabilities disclosed in the same advisory (CTX697096) — including CVE-2026-88771 and CVE-2026-88772, which involve pre-authentication RCE — generated significant industry attention, with CISA issuing an alert and multiple national CERTs (UK NCSC, CERT-EU, Canadian Centre for Cyber Security, Irish NCSC, New Zealand NCSC) publishing advisories urging immediate patching (CISA Alert, UK NCSC). Security vendors including Tenable, Sophos, Rapid7, Qualys, Palo Alto Unit 42, and watchTowr published detailed analyses and detection guidance for the vulnerability cluster. CVE-2026-88773 specifically attracted researcher commentary on the elegance of the integer-wrap technique, with a dev.to post titled "Request smuggling in NetScaler: why the backend's parsing rules decide the impact" providing additional technical context. Social media discussion on Mastodon and X (Twitter) highlighted the severity of the overall NetScaler zero-day cluster, with DarkWebInformer and other threat intelligence accounts amplifying the disclosure (Tenable FAQ, Sophos Blog).