CVE-2026-88773: 
Citrix ADC VPX vulnerability analysis and mitigation

CVE-2026-88773 is an HTTP Request Smuggling vulnerability (CWE-444) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, disclosed on September 27, 2026. It affects NetScaler ADC versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 (NDcPP), and NetScaler Gateway versions before 14.1-73.37 FIPS and before 13.1-64.23. The vulnerability allows unauthenticated remote attackers to bypass security policies and filtering controls through inconsistent HTTP request parsing between the gateway and backend systems. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Citrix Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling), where NetScaler ADC and Gateway — acting as intermediary HTTP agents — parse malformed or ambiguous HTTP requests differently than the backend systems they proxy to. This discrepancy allows an attacker to craft specially formed HTTP requests that are interpreted one way by the NetScaler appliance and another way by the backend server, effectively smuggling requests past security controls. The attack requires no authentication, no user interaction, and no special privileges, and is exploitable remotely over the network with low complexity (GitHub Advisory, Citrix Advisory).

Successful exploitation allows an unauthenticated attacker to bypass security policies and filtering controls enforced by NetScaler ADC and Gateway, potentially accessing backend resources or executing actions that should be blocked by the appliance. The CVSS v4.0 scoring reflects high integrity impact on both the vulnerable system and subsequent (backend) systems, as well as high confidentiality impact on subsequent systems, meaning attackers could access sensitive data or manipulate backend application state. While direct availability impact is not scored, the security bypass nature of this vulnerability could facilitate further attacks, including unauthorized access to internal applications and lateral movement within protected network segments (GitHub Advisory, Citrix Advisory).

As of the disclosure date (September 27, 2026), there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation specific to CVE-2026-88773. The EPSS score is reported as 0.0, indicating low current probability of exploitation. However, this CVE was disclosed alongside a broader set of NetScaler vulnerabilities (CVE-2026-88771 through CVE-2026-88778), some of which involve actively exploited RCE zero-days, which may increase attacker interest in the full vulnerability set (GitHub Advisory, CISA Alert).

1. Reconnaissance: Identify internet-facing Citrix NetScaler ADC or Gateway instances using tools like Shodan or Censys, targeting versions before 14.1-73.37 or 13.1-64.23.
2. Craft smuggled HTTP request: Construct an ambiguous HTTP request that exploits discrepancies in how NetScaler parses HTTP headers (e.g., conflicting Content-Length and Transfer-Encoding headers, or malformed chunked encoding) to smuggle a secondary request.
3. Submit to NetScaler endpoint: Send the crafted request to a publicly accessible NetScaler ADC or Gateway HTTP/HTTPS listener, causing the appliance to forward a smuggled request to the backend server that bypasses the appliance's security policy evaluation.
4. Access restricted resources: The smuggled request reaches the backend application as if it originated from a trusted or authorized source, potentially allowing access to protected endpoints, authentication bypass, or injection of malicious content into other users' sessions (GitHub Advisory, Citrix Advisory).

• Network: Unusual or malformed HTTP requests to NetScaler ADC/Gateway listeners containing conflicting Content-Length and Transfer-Encoding headers, or malformed chunked encoding sequences; unexpected backend requests originating from the NetScaler appliance's internal IP that do not correspond to legitimate client sessions.
• Logs: NetScaler access logs showing HTTP requests with anomalous header combinations or oversized/malformed payloads; backend application logs recording requests from the NetScaler proxy IP that do not match any corresponding client-side request in the ADC logs.
• Application: Unexpected access to restricted backend resources or endpoints that should be blocked by NetScaler security policies; session anomalies in backend applications such as requests appearing to come from other users' sessions.

Citrix has released patched versions addressing CVE-2026-88773. Administrators should upgrade to the following fixed versions as soon as possible:

• NetScaler ADC: 14.1-73.37 or later, 13.1-64.23 or later, 14.1-73.37 FIPS or later, 13.1-37.279 NDcPP or later
• NetScaler Gateway: 14.1-73.37 FIPS or later, 13.1-64.23 or later

No specific configuration-based workaround has been published; upgrading to a patched version is the recommended remediation. Administrators should also monitor HTTP traffic for anomalous request patterns and review backend application logs for signs of unexpected access (Citrix Advisory, GitHub Advisory).

The disclosure of CVE-2026-88773 occurred alongside a broader set of NetScaler vulnerabilities, some involving actively exploited RCE zero-days, which drew significant attention from the security community. CISA issued an alert regarding critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway, and national CERTs including CERT-EU, Ireland's NCSC, and the Canadian Centre for Cyber Security (CCCS) published advisories covering the vulnerability set. Security news outlets including The Hacker News, CyberSecurityNews, and Heise covered the broader NetScaler zero-day crisis, and social media accounts such as DarkWebInformer highlighted the disclosures on X (formerly Twitter) and Mastodon (CISA Alert, CERT-EU Advisory, CCCS Advisory).