Upgrade NetScaler: researchers publish PoC for request smuggling flaw CVE-2026-88773

Timing: Citrix fixed this flaw on 27 September 2026. A researcher PoC appeared on 1 November. We checked all facts on 2 November 2026.

What happened

An unauthenticated attacker on the network may be able to smuggle HTTP requests through a vulnerable NetScaler. The flaw is CVE-2026-88773, rated CVSS 4.0 9.3 (Critical).

Citrix disclosed it in bulletin CTX697096 on 27 September 2026. It sits in the same bulletin as the exploited NetScaler command execution flaw CVE-2026-88771. It is classed CWE-444, inconsistent interpretation of HTTP requests.

On 1 November 2026, a researcher published a proof of concept on GitHub. It builds on an earlier write-up by Scyrix. The repository holds a Python script and no binaries. Its commit message calls it a "functional non-weaponized research proof-of-concept".

Who is affected

Customer-managed NetScaler ADC and NetScaler Gateway are affected below these builds:

• 14.1: before 14.1-73.37
• 13.1: before 13.1-64.23
• ADC 14.1 FIPS: before 14.1-73.37 FIPS
• ADC 13.1-FIPS and NDcPP: before 13.1-37.279

There is one precondition. The appliance must have an HTTP configuration. Citrix means an HTTP or SSL type vserver: Load Balancing, Content Switching, VPN or Authentication.

Only customer-managed deployments are in scope. Secure Private Access hybrid deployments that use these instances must also upgrade.

What is confirmed

• The flaw and the fix. Citrix bulletin CTX697096 lists the affected and fixed builds above.
• The score. CVSS 4.0 9.3. NVD lists the record as Analyzed.
• No workaround. Citrix offers only the upgrade.
• No exploitation reported. Citrix says it saw in-the-wild exploits for CVE-2026-88771 and CVE-2026-88772 only, not for this CVE.
• Not in CISA KEV. We checked catalog 2026.10.30 on 2 November.
• The credits. Citrix credits the JPMorgan Chase XOR Team (Michael Tucker, Chew Keong Tan) and Maxim Suhanov.

What is not confirmed

Citrix has not published technical details for CVE-2026-88773. So the link between the public PoC and this CVE is the researchers' claim.

The researchers describe the bug at a high level. A very long chunk size overflows a 32-bit counter in NetScaler. What follows depends on the backend server. It can stall the connection, a denial of service. Or a second, hidden request can reach the backend.

That claim fits the CWE-444 class and the CVSS impact. It is plausible, but Citrix has not confirmed it. The researchers tested only an old lab build, 14.1-12.30 from 2023.

ThreatWire has not run the PoC. We do not reprint any requests or code. No GitHub Security Advisory exists for this CVE.

What to do

1. Upgrade. The minimum fix is 14.1-73.37 or 13.1-64.23. We recommend 14.1-73.49 or 13.1-64.32. Those builds also fix PHP2Shell, as covered in our NetScaler PHP2Shell story. FIPS and NDcPP builds have their own fixed versions.
2. Check exposure. List every appliance with an HTTP or SSL vserver for Load Balancing, Content Switching, VPN or Authentication. Then compare each build with the fixed builds above. (ThreatWire advice.)
3. Use NetScaler Console. Citrix documents how to detect and remediate CVE-2026-88773 in NetScaler Console.
4. Prioritize Gateways. Internet-facing Gateway and authentication vservers are the most reachable targets. (ThreatWire advice.)

If you already upgraded for CVE-2026-88771, you are covered for this CVE too. The fixed builds are the same.

Sources

Record: CVE-2026-88773.

Sources: Citrix bulletin CTX697096, NVD, NetScaler Console documentation, the researcher repositories and the CISA KEV catalog. Links are in the references list.