CVE-2026-88773: Critical HTTP Request Smuggling in Citrix NetScaler ADC and Gateway

CVE-2026-88773 is a critical HTTP request/response smuggling vulnerability (CWE-444) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. This vulnerability was disclosed on September 27, 2026, as part of Citrix Security Bulletin CTX697096. The vulnerability occurs due to inconsistencies in how HTTP requests are sanitized, parsed, and forwarded to backend servers.

The NetScaler appliance serves as a front-end reverse proxy or load balancer, managing multiplexed TCP connections to downstream web applications. By design, NetScaler reuses downstream persistent connections for multiple incoming user sessions to optimize performance. This architecture introduces a significant attack surface if request boundaries are processed inconsistently.

An unauthenticated remote attacker can exploit this issue by crafting malformed HTTP requests containing conflicting boundary indicators. When these requests are routed, the downstream backend server retains the smuggled payload in its buffer. This payload is subsequently prepended to the next legitimate user's request, resulting in session hijack or security policy bypass.

The underlying flaw stems from inconsistent interpretation of HTTP requests (CWE-444) between NetScaler and backend web servers. When processing HTTP/1.1 message bodies, servers determine request boundaries using either the Content-Length header or the Transfer-Encoding: chunked header. A discrepancy occurs if the proxy and the backend prioritize these headers differently or disagree on malformed header syntax.

For instance, if the proxy processes a request based on Content-Length but the backend processes it based on Transfer-Encoding, the backend parses a different portion of the HTTP body as the completion of the request. The trailing bytes of the attacker's request are then treated as the start of a subsequent HTTP request.

This behavior is highly exploitable because NetScaler implements TCP connection multiplexing. To reduce the overhead of initiating three-way handshakes with backend servers, NetScaler maintains persistent TCP pools. Because multiple client sessions share the same downstream TCP socket, an attacker can reliably prefix a smuggled payload onto the request stream of an unrelated, legitimate user.

The request smuggling mechanism relies on synchronization loss between the proxy's outgoing stream and the backend's incoming parser. The diagram below illustrates the flow of the attack when a shared TCP socket is used to multiplex incoming user connections.

In this scenario, the NetScaler and the backend server process different boundaries. The backend server holds the remainder of the attacker's data in its stream buffer. When the legitimate user's request is multiplexed over the same TCP connection, the backend appends the user's headers to the smuggled payload, executing the smuggled action.

Exploitation requires no authentication and can be completed via direct HTTP requests. In a Content-Length vs. Transfer-Encoding (CL.TE) scenario, the attacker issues a single POST request containing both headers. NetScaler prioritizes Content-Length while the backend prioritizes Transfer-Encoding.

POST / HTTP/1.1
Host: target.example.com
Content-Length: 4
Transfer-Encoding: chunked
 
1
Z
0
 
GET /admin/delete_user?id=99 HTTP/1.1
Host: target.example.com
Dummy: 

In this packet payload, the NetScaler reads the Content-Length: 4 and forwards only the first 4 bytes of the body (up to 1\r\nZ\r\n) to the backend. The backend, reading the request as chunked, identifies the 0 chunk as the message terminator and parses the remaining GET request as the beginning of the subsequent request. When a legitimate user's request arrives, it is appended to the Dummy: header, making the entire operation execute under the user's session context.

The impact of CVE-2026-88773 is rated as critical, with a CVSS v3.1 base score of 10.0 and a CVSS v4.0 score of 9.3. Successful exploitation allows complete security boundary bypass. If the front-end NetScaler is configured to perform authorization checks, an attacker can bypass these completely by smuggling requests to backend components that trust the NetScaler's upstream validation.

Type-specific session hijacking is achievable without user interaction. When a legitimate user's request is appended to the smuggled payload, the user's cookie headers are often forwarded as query parameters or headers in the smuggled request, exposing them to the attacker via log files or application responses.

Local web cache poisoning is another significant threat. Attackers can smuggle a request that maps a legitimate static resource to a malicious page. If NetScaler or an intermediate cache stores this combined response, subsequent users requesting the legitimate page will receive the malicious payload.

An appliance is vulnerable only if it is configured to run active virtual servers handling HTTP or SSL traffic. Administrators must audit configuration files to assess exposure. This requires searching both the default partition and all active admin partitions for virtual servers using vulnerable protocols.

Administrators can inspect the /nsconfig/ns.conf file directly using the command line shell. The following command pattern identifies exposed configurations:

grep -iE -e "^add (lb|cs|vpn|authentication) vserver ("[^"]*"|[^ ]+) (HTTP|SSL) " /nsconfig/ns.conf

If the command returns output lines and the appliance is running an affected firmware version, the system is exposed. For systems utilizing administrative partitions, configurations under /nsconfig/partitions/*/ns.conf must also be searched recursively to ensure complete audit coverage.

To remediate CVE-2026-88773, administrators must upgrade to fixed releases of NetScaler ADC and Gateway. For 14.1 deployments, upgrade to 14.1-73.37 or later. For 13.1 deployments, upgrade to 13.1-64.24 or later (this version avoids a known cyclic-reboot issue present in build 13.1-64.23).

If immediate upgrading is impossible, temporary workarounds include disabling connection multiplexing on HTTP profiles or configuring strict header checking on downstream web servers. However, these changes may degrade performance or disrupt application functionality.

As part of general gateway hardening, Citrix also recommends enabling Enhanced ISN Generation on all active partitions. This parameter mitigates TCP sequence prediction risks (CVE-2026-88778) and can be enabled via CLI using set ns tcpparam -enhancedISNgeneration ENABLED.