External risk intelligence

Citrix NetScaler HTTP Request Smuggling Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-88773

Citrix NetScaler ADC and Gateway are designed to function as internet-facing appliances, serving as application delivery controllers, VPN entry points, and gateways that handle incoming web traffic at the network edge.

Citrix Netscaler Application Delivery Controller

13.1 to before 13.1-64.2313.1 to before 13.1.37.27914.1 to before 14.1-73.3714.1-66.68 to 14.1-73.37

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an issue within Citrix NetScaler ADC and Gateway products that could allow attackers to interfere with how these systems process web traffic. The vulnerability lies in the inconsistent interpretation of HTTP requests, potentially enabling sophisticated attacks if exploited. The main concern is confirming if our organization utilizes these specific Citrix products and whether they are exposed to external networks.

Web traffic processing is inconsistently interpreted.
Affects critical network edge security devices.
Confirm product relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted HTTP requests to a vulnerable Citrix NetScaler device. These requests, when processed inconsistently by the device, can lead to HTTP Request/Response smuggling. This smuggling technique allows an attacker to bypass security controls and potentially gain unauthorized access or manipulate traffic passing through the NetScaler.

No specific user interaction needed.
Smuggled HTTP requests trigger vulnerability.
High risk of unauthorized access and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to interfere with how Citrix NetScaler appliances interpret HTTP requests. This could lead to unexpected behavior or the exposure of sensitive information when supported by the advisory's conditions.

Network traffic processing.
Malicious requests may bypass security.
Unauthorized data access or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical HTTP Request/Response smuggling vulnerability in Citrix NetScaler ADC and Gateway requires immediate attention from infrastructure and security teams. The first practical step is to identify all deployed instances, confirm their exposure and criticality, and then coordinate with the relevant application or platform owners to plan remediation during the next maintenance window.

Infrastructure and Security teams own remediation.
Verify external accessibility and asset criticality.
Plan remediation within maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Citrix NetScaler ADC and Gateway?

These products function as network edge devices that manage, optimize, and secure web traffic. NetScaler ADC acts as an application delivery controller to balance server loads, while NetScaler Gateway provides secure remote access, such as VPN functionality, for users connecting to internal resources.

What does CVE-2026-88773 mean?

This CVE identifies a weakness known as HTTP Request/Response smuggling, classified as CWE-444. It occurs when a system interprets the boundaries of incoming HTTP requests inconsistently. This flaw allows an attacker to manipulate how the device forwards or processes these requests, potentially leading to unauthorized actions or data access.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted HTTP requests to the appliance. The vulnerability arises from how the NetScaler parses these requests compared to downstream servers. It does not require any specific user interaction or authentication to initiate, as the system processes the malformed requests automatically upon receipt.

Is my NetScaler device relevant to this threat?

Halo Surface Signal notes that NetScaler ADC and Gateway are typically deployed as internet-facing appliances at the network edge. Because these devices are designed to handle incoming web traffic directly from the internet, any instance exposed to public networks is significantly more relevant and requires immediate priority assessment.

What is the first step to address this?

You should begin by creating an inventory of all Citrix NetScaler instances within your environment. Verify which ones are reachable from the internet, as these represent the primary risk. Once identified, work with your infrastructure teams to schedule updates to the corrected software versions listed in the vendor advisory.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.