CVE-2026-88773

Executive Summary

CVE-2026-88773 is an HTTP Request/Response Smuggling vulnerability (CWE-444) arising from inconsistent interpretation of HTTP requests in Citrix NetScaler ADC and Citrix NetScaler Gateway. Because these appliances sit at the network edge and terminate or forward HTTP traffic, a successful smuggling attack can desynchronize front-end and back-end HTTP parsing, enabling request hijacking, cache poisoning, credential theft, and bypass of access controls enforced by the appliance. Organizations running unspecified affected ADC or Gateway builds prior to the fixed releases are exposed at the perimeter and must treat this as a high-priority edge-device issue.

Technical Analysis

The root cause is inconsistent interpretation of HTTP requests — the vulnerability class cataloged as CWE-444, commonly referred to as HTTP Request Smuggling (and, in the response direction, HTTP Response Smuggling). This flaw class occurs when two HTTP-processing components in a chain (for example, a front-end proxy/appliance and a back-end origin server) disagree about where one request ends and the next begins. The classic mechanisms are:

• Conflicting framing headers: A request that contains both a Content-Length header and a Transfer-Encoding: chunked header can be parsed differently depending on which header each component trusts. If the front-end honors one and the back-end honors the other, surplus bytes are left in the connection buffer and are prepended to the next request on that connection.
• Malformed chunked encoding: Obfuscated or non-canonical chunk terminators can be accepted by one parser and rejected or reinterpreted by another, producing the same desynchronization effect.
• Header obfuscation / whitespace and case normalization differences: Components that normalize header names, handle duplicate headers, or strip/accept unusual whitespace differently can reach divergent interpretations of the same byte stream.

In the context of NetScaler ADC and Gateway, these appliances act as the HTTP-aware front end in front of application servers. When the appliance and the upstream server interpret the request boundary differently, an attacker can "smuggle" a second, attacker-controlled request that is processed by the back end while appearing to belong to a different user's connection or session. The NVD description does not disclose the specific parser discrepancy, the exact header combination, or any internal function names — those implementation details are not available and must not be assumed. What is established is the vulnerability class (CWE-444) and the affected product family and version boundaries.

Attack surface: any HTTP/HTTPS virtual server, content-switching configuration, or Gateway/AAA virtual server that proxies or forwards HTTP traffic through the affected appliance. The flaw is network-reachable (AV:N) but typically requires precise, timing- or byte-level request construction, which raises attack complexity.

Exploitation Scenarios

No public Proof-of-Concept, exploit code, or Nuclei template is available for CVE-2026-88773. The following chain is inferred from the vulnerability class (CWE-444) and is not derived from a published exploit.

1. Reconnaissance / target identification. The attacker identifies internet-facing Citrix NetScaler ADC or Gateway appliances using banner/HTTP fingerprinting (for example, HTTP response headers, login portal pages, and TLS certificate subjects characteristic of NetScaler). Because affected appliance builds are edge-exposed, they are discoverable via standard internet scanning.

2. Triggering the flaw class. The attacker sends a crafted HTTP request that exploits the parsing inconsistency between the NetScaler HTTP front end and the back-end server. At the class level, this involves ambiguous request framing — typically a combination of headers that the two HTTP parsers resolve to different message boundaries, leaving attacker-controlled bytes in the connection buffer to be interpreted as the start of a subsequent request. The exact header sequence is not disclosed and would need to be determined empirically.

3. Payload / execution method (class-level). The smuggled bytes form a second HTTP request. That request is processed by the back-end (or by the next user's session being forwarded through the appliance), allowing the attacker to influence how downstream components handle a request that appears to originate from the appliance or from a different client.

4. Post-exploitation impact (class-level). Depending on configuration, HTTP smuggling can enable: bypass of front-end access-control or authentication checks enforced by the appliance; request/response queue poisoning affecting other users on shared connections; cache poisoning where a caching layer is present; and capture or manipulation of other users' requests — potentially including session tokens or credentials. The CVSS vector reflects high confidentiality and integrity impact with a changed scope (S:C), consistent with effects that cross the trust boundary between the appliance and back-end systems.

Given CVSS AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitation is remote and unauthenticated but requires high attack complexity — consistent with the byte-precise nature of smuggling attacks.

Impact Assessment

• Confidentiality (C:H): Smuggled requests can cause a victim's subsequent request — including credentials or session cookies — to be appended to attacker-controlled traffic and captured.
• Integrity (I:H): The attacker can inject or alter requests as seen by the back end, potentially bypassing security controls enforced by the appliance.
• Availability (A:N): No direct denial-of-service is indicated by the assigned vector.
• Scope (S:C): Impact extends beyond the vulnerable component into the back-end application and other users sharing the HTTP connection path.
• Attack Vector/Complexity: Network-reachable (AV:N), high complexity (AC:H), no privileges (PR:N) or user interaction (UI:N) required.

Blast radius: NetScaler ADC and Gateway appliances frequently front authentication, remote-access (Gateway/AAA), load-balancing, and application-delivery functions for many downstream applications. A compromise at this layer can affect every service published through the appliance. Because Gateway provides remote access, request smuggling at the Gateway tier can have outsized impact on enterprise remote-work traffic.

Caveat: No CVSS base score, EPSS score, or CISA KEV listing is available in the supplied data; severity ranking is therefore based on the vector characteristics alone and cannot be benchmarked against FIRST.org scoring.

Detection Guidance

Note: Because no exploit is public, these detections target the CWE-444 class signature — ambiguous/conflicting HTTP framing headers and request-boundary anomalies — rather than a known payload.

Sigma Rule

title: Potential HTTP Request Smuggling via Conflicting Framing Headers
id: 9f1c4b2a-7e3d-4a1b-8c5f-cve202688773
status: experimental
description: Detects HTTP requests containing conflicting Content-Length and Transfer-Encoding
  headers or unusual Transfer-Encoding obfuscation, indicative of CWE-444 request smuggling
  against Citrix NetScaler ADC/Gateway (CVE-2026-88773).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88773
  - https://cwe.mitre.org/data/definitions/444.html
author: valtersit.com Threat Intelligence
logsource:
  category: webserver
detection:
  selection_te_cl:
    - cs-uri-query|contains:
        - 'Transfer-Encoding'
        - 'transfer-encoding'
    - cs-headers|contains: 'Content-Length'
  selection_te_obfuscation:
    cs-headers|re: '(?i)(transfer\s*-\s*encoding|transfer_encoding|chunked\s*,\s*chunked|\\x0b|\\x0c)'
  selection_cl_duplicate:
    cs-headers|re: '(?i)(content-length:.*content-length:|content-length:\s*\+|content-length:\s*-)'
  condition: selection_te_cl and 1 of selection_te_obfuscation,selection_cl_duplicate
falsepositives:
  - Legitimate clients/proxies that emit both headers (rare; should be investigated)
  - Security scanners performing protocol conformance testing
level: high

YARA Rule

rule CVE_2026_88773_HTTP_Smuggling
{
    meta:
        description = "Detects HTTP request artifacts consistent with CWE-444 request smuggling (CVE-2026-88773, Citrix NetScaler ADC/Gateway)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88773"
        date = "2026-01-01"
        severity = "high"

    strings:
        $te  = "Transfer-Encoding" nocase
        $cl  = "Content-Length" nocase
        $chk = "chunked" nocase
        $te2 = "transfer-encoding" nocase

    condition:
        (uint16(0) != 0x4854) and   // not a raw "HT" HTTP response start ; adjust per corpus
        filesize < 8KB and
        (($te and $cl) or ($te2 and $chk))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88773 Possible HTTP Request Smuggling - Conflicting TE/CL Headers"; flow:established,to_server; http.header_names; content:"Transfer-Encoding"; nocase; http.header_names; content:"Content-Length"; nocase; reference:cve,2026-88773; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88773; classtype:attempted-admin; sid:202688773; rev:1;)

alert http any any -> any any (msg:"CVE-2026-88773 HTTP Request Smuggling - Obfuscated Transfer-Encoding"; flow:established,to_server; http.header; content:"Transfer-Encoding"; nocase; pcre:"/Transfer-Encoding[^\r\n]*[\\x0b\\x0c]|Transfer-Encoding[^\r\n]*(chunked[^\r\n]*chunked)/i"; reference:cve,2026-88773; classtype:attempted-admin; sid:202688774; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method is not null and
      http.request.headers contains "Transfer-Encoding" ]
  [ network where http.request.headers contains "Content-Length" and
      http.request.headers contains "Transfer-Encoding" ]

(EQL for network/HTTP events; correlates a request carrying both Transfer-Encoding and Content-Length on the same source within a short window — a classic smuggling indicator.)

Splunk SPL Query

index=proxy OR index=web
| eval hdrs = lower(coalesce(http_request_headers, cs_headers, headers))
| where match(hdrs, "transfer-encoding") AND match(hdrs, "content-length")
| stats count values(uri) as uris values(dest_ip) as dests by src_ip
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-88773,">
  <rule id="100773" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex>Transfer-Encoding.*Content-Length|Content-Length.*Transfer-Encoding</regex>
    <description>CVE-2026-88773: Possible HTTP request smuggling (conflicting Transfer-Encoding and Content-Length headers)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100774" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex>Transfer-Encoding[\s\S]*chunked[\s\S]*chunked</regex>
    <description>CVE-2026-88773: Possible HTTP request smuggling (duplicate/obfuscated chunked encoding)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED per tracked sources (no patch evidence). Note: the NVD description references fixed version thresholds, but no patch source was confirmed by the tracked patch feeds, so treat remediation as verification-required.

1. Immediate mitigations

   • Restrict management and virtual-server access to trusted networks; do not expose ADC/Gateway management interfaces to the internet.
   • Normalize HTTP at the edge: enable strict HTTP parsing options where available and reject requests containing both Content-Length and Transfer-Encoding, or ambiguous/obfuscated chunked encoding, at the perimeter.
   • Where a downstream reverse proxy or WAF sits in front of the appliance, configure it to drop requests with conflicting framing headers.
   • Isolate back-end HTTP/1.1 keep-alive reuse behavior to reduce the window for queue poisoning (for example, minimize connection reuse across trust boundaries).

2. Patch/upgrade steps

   • The NVD description identifies the following fixed thresholds; upgrade to or beyond these versions and verify against the official Citrix advisory:
     • ADC: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 (and NDcPP)
     • Gateway: 14.1-73.37 FIPS, 13.1-64.23
   • Because patch confidence is 0/4 from tracked sources, confirm the authoritative Citrix security bulletin and release notes before declaring closure.

3. Long-term hardening

   • Enforce HTTP/2 end-to-end where possible (HTTP/2 framing removes many HTTP/1.1 smuggling primitives), or ensure consistent strict HTTP/1.1 parsing across all hops.
   • Adopt a single, authoritative request-framing standard and reject non-conformant messages at the edge.
   • Monitor continuously for conflicting-framing-header anomalies (see Detection Guidance) and alert on them.
   • Maintain an inventory of internet-facing ADC/Gateway appliances and track them against Citrix security advisories.

References

• NVD — CVE-2026-88773: https://nvd.nist.gov/vuln/detail/CVE-2026-88773
• CWE-444 — Inconsistent Interpretation of HTTP Requests: https://cwe.mitre.org/data/definitions/444.html
• CITRIX NetScaler ADC/Gateway security bulletins: https://support.citrix.com/security-center/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no KEV listing for this CVE as of the data provided)
• FIRST EPSS: https://www.first.org/epss/ (no score available as of the data provided)

Note: No public PoC, exploit code, Nuclei template, or confirmed in-the-wild campaign is associated with CVE-2026-88773 in the supplied data. All exploitation details above are inferred from the CWE-444 vulnerability class.