HTTP request smuggling on NetScaler ADC and Gateway (CVE-2026-88773)
Not every serious appliance bug is a memory corruption. In the September 2026 NetScaler release, CVE-2026-88773 is an HTTP request smuggling flaw rated 9.3 on CVSS v4. The precondition is simply that HTTP functionality is enabled on NetScaler ADC or Gateway, and neither authentication nor user interaction is required. CVE-2026-88776, the 8.8 memory overflow this topic is filed under, is fixed by the same update.
Vulnerability set at a glance
| CVE | CVSS v4 | Weakness and outcome | Precondition | Exploitation |
|---|---|---|---|---|
| CVE-2026-88771 | 9.5 | Insufficient input validation; unauthenticated remote command execution | All ADC and Gateway deployments | Confirmed exploited |
| CVE-2026-88772 | 9.5 | Memory overflow allowing remote code execution or denial of service | DTLS enabled (default on a VPN virtual server) | Confirmed exploited |
| CVE-2026-88773 | 9.3 | HTTP request smuggling | HTTP functionality enabled | Not reported |
| CVE-2026-88774 | 7.0 | Feature policy bypass via HTTP URL-based policy expressions | URL-based policy expressions configured | Not reported |
| CVE-2026-88775 | 8.8 | Memory overflow causing unpredictable behaviour or denial of service | Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server | Not reported |
| CVE-2026-88776 | 8.8 | Memory overflow causing unpredictable behaviour or denial of service | Oracle-type load-balancing virtual server | Not reported |
| CVE-2026-88777 | 8.8 | Memory overflow causing unpredictable behaviour or denial of service | LB, CS or CGNAT-LSN/NAT64 with a non-HTTP Layer 7 protocol | Not reported |
| CVE-2026-88778 | 8.8 | Predictable TCP initial sequence numbers | TCP functionality enabled | Not reported |
How request smuggling fits an appliance
A NetScaler appliance frequently sits between the internet and an application server, which is exactly the position where inconsistent parsing of HTTP requests becomes dangerous. When a device and the server behind it disagree about where one request ends and the next begins, an attacker can slip a second request past the front-end controls or poison the connection of another user. The advisory classifies the weakness under inconsistent interpretation of HTTP requests, the standard label for this family.
The practical consequence depends on what sits behind the appliance. On a reverse proxy in front of an application, smuggled requests can bypass access rules, poison caches or reach endpoints that were meant to be internal.
The rest of the release
CVE-2026-88771 and CVE-2026-88772 are the two flaws Citrix has seen used in the wild, both at 9.5. Beyond those, the advisory lists CVE-2026-88774, a feature policy bypass rated 7.0 that needs HTTP URL-based policy expressions to be configured, and a cluster of 8.8 memory overflow and predictability issues that includes CVE-2026-88776.
Impact
The disclosed outcome for CVE-2026-88773 is request smuggling with no authentication required. Where the appliance is enforcing access control on HTTP traffic, a successful smuggle can undermine that control at the protocol level rather than by breaking an application.
Affected products and scope
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
- NetScaler ADC FIPS before 14.1-73.37 FIPS
- NetScaler ADC FIPS and NDcPP before 13.1-37.279
Remediation
Citrix has issued security updates and the NCSC recommends applying them without delay. The fixed builds are:
- 14.1-73.37 and later (14.1 branch)
- 13.1-64.23 and later (13.1 branch)
- 14.1-73.37 FIPS and later (FIPS branch)
- 13.1-37.279 and later (FIPS / NDcPP branch)
Because CVE-2026-88771 and CVE-2026-88772 have been observed in the wild, the NCSC adds guidance that goes beyond a normal patch cycle. Before installing the update, preserve relevant logging and take a memory dump, so that forensic evidence of any earlier compromise remains available. Installing the update stops new exploitation but does not rule out that a system was already breached, so organisations that were exposed before patching should also assess for prior compromise.
Exposure context
A ZoomEye search with the product fingerprint app="Citrix NetScaler" reports 239.3k matching instances, which places the population of internet-reachable NetScaler deployments well above the threshold at which this class of flaw warrants urgent attention. NetScaler appliances commonly sit directly on the internet as VPN concentrators and load balancers, so a reachable management or data plane usually means no additional network foothold is needed to attempt exploitation.
Sources
- NCSC-2026-0394, Netherlands Cyber Security Center, 27 September 2026.
- Citrix security bulletin CTX697096 for CVE-2026-88771 through CVE-2026-88778.
Top comments (1)
For appliances exposed to the internet, the patch plan should include a verification step after upgrade: confirm the exact build, review HTTP listener configuration, and look for anomalous proxy behavior around the patch window. That is more defensible than treating the advisory as a version-only exercise, especially when exploitation is described as confirmed.