CVE-2026-88773 in NetScaler ADC
Summary
by MITRE • 09/27/2026
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
HTTP request smuggling is a critical class of vulnerabilities that arises when there is an inconsistency in how two different HTTP servers interpret the boundaries between requests within a single TCP connection. In the context of Citrix NetScaler ADC and Citrix NetScaler Gateway, this vulnerability stems from discrepancies in parsing logic between the front-end load balancer or reverse proxy and back-end application servers. When these components disagree on whether to treat certain headers as part of the current request body or as the start of a subsequent request, an attacker can manipulate the stream to inject malicious requests that appear legitimate to one system but are processed differently by another. This misalignment allows attackers to bypass security controls such as access control lists and firewalls that rely on consistent interpretation of incoming traffic.
The technical flaw typically involves the handling of ambiguous HTTP headers like Content-Length and Transfer-Encoding, which define how a server should read the body of an HTTP message. If one layer strips or modifies these headers while another does not, it creates a desynchronization point. For instance, if NetScaler ADC removes a header before forwarding to a backend server that expects it, the backend may misinterpret where one request ends and the next begins. This allows an attacker to smuggle arbitrary HTTP requests into the internal network infrastructure. These smuggled requests can be crafted to perform unauthorized actions on behalf of other users, access sensitive data stored in response buffers intended for previous legitimate requests, or even execute server-side code if the backend is vulnerable to injection attacks that are normally filtered by the front-end proxy.
The operational impact of this vulnerability is severe and multifaceted. It compromises confidentiality as attackers can read private information from cached responses belonging to other users due to buffer poisoning techniques inherent in request smuggling. Integrity is compromised because attackers can modify or inject requests into internal systems, potentially altering application behavior or data states without authorization. Availability may also be affected if the desynchronization causes connection resets or resource exhaustion on backend servers. Furthermore, this vulnerability facilitates session hijacking and privilege escalation by allowing attackers to impersonate other users or access administrative interfaces that should remain restricted. The risk is particularly acute in environments where NetScaler acts as a reverse proxy for sensitive internal applications, making it a prime target for exploitation by sophisticated threat actors seeking lateral movement within corporate networks.
Mitigation strategies must focus on ensuring consistent HTTP parsing logic across all layers of the infrastructure. Organizations running affected versions of Citrix NetScaler ADC and Gateway should immediately apply the vendor-provided patches to align request interpretation mechanisms. Specifically, updates before version 14.1-73.37 for non-FIPS builds, before 13.1-64.23 for standard releases, and specific FIPS or NDcPP compliant versions must be installed to resolve these parsing inconsistencies. Beyond patching, administrators should configure their NetScaler devices to reject ambiguous HTTP requests that contain conflicting Content-Length and Transfer-Encoding headers, as recommended by industry best practices. Implementing strict input validation on backend servers can also provide a secondary layer of defense against smuggled payloads.
This vulnerability aligns with CWE-440, which describes the expected behavior of an application being different from its actual behavior due to inconsistent interpretation of inputs. It is closely related to CWE-697 regarding incorrect comparison and CWE-20 for improper input validation. From a tactical perspective, this flaw supports ATT&CK technique T1534, specifically sub-technique Internal Spearphishing or more accurately in this context, it facilitates lateral movement through request manipulation which can be categorized under Command and Control or Defense Evasion depending on the specific exploitation method used to bypass security controls. Security teams should monitor for unusual HTTP traffic patterns that indicate potential smuggling attempts, such as requests with malformed headers or unexpected response codes following complex header combinations. Regular vulnerability assessments focusing on web application firewalls and reverse proxy configurations are essential to maintain resilience against this class of attacks.