CVE-2026-88773

CVE-2026-88773 is an HTTP request smuggling flaw in Citrix NetScaler ADC and NetScaler Gateway. It is classed CWE-444, inconsistent interpretation of HTTP requests. The CVSS 4.0 score is 9.3 (Critical). NVD lists the record as Analyzed.

Citrix published it in bulletin CTX697096 on 27 September 2026. The same bulletin covers CVE-2026-88771 to CVE-2026-88778.

Precondition: Citrix says the appliance must have an HTTP configuration. That means an HTTP or SSL type vserver: Load Balancing, Content Switching, VPN or Authentication. Only customer-managed deployments are in scope. Secure Private Access hybrid deployments that use those instances must also upgrade.

Fixed builds: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 for FIPS and NDcPP, plus later builds. Citrix lists no workaround. In practice, ThreatWire recommends 14.1-73.49 or 13.1-64.32. Those builds also fix PHP2Shell, as explained in our NetScaler PHP2Shell story.

Exploitation: Citrix reports in-the-wild exploitation only for CVE-2026-88771 and CVE-2026-88772, not for this CVE. CVE-2026-88773 is not in the CISA KEV catalog (catalog 2026.10.30).

PoC status: a researcher-published proof of concept appeared on GitHub on 1 November 2026. It builds on a write-up by Scyrix. The researchers say a very long chunk size overflows a 32-bit counter. The result depends on the backend: a stuck connection, or a second smuggled request. Citrix has not published technical details, so the link between this PoC and CVE-2026-88773 is the researchers' claim. It is plausible but not confirmed by Citrix. The PoC was tested only on an old 2023 lab build. ThreatWire has not run it. We do not reprint any requests.

Citrix credits the JPMorgan Chase XOR Team (Michael Tucker, Chew Keong Tan) and Maxim Suhanov. Facts checked on 2 November 2026. Read our explainer.