{"uuid": "fc9f0e58-892a-4ac2-9781-a1e8f6461bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://gist.github.com/alon710/8178acb7c07fdcab127104f7b77df5ce", "content": "# CVE-2026-88773: CVE-2026-88773: Critical HTTP Request Smuggling in Citrix NetScaler ADC and Gateway\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-09-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88773\n\n## Summary\nA critical HTTP request/response smuggling vulnerability (CWE-444) exists in Citrix NetScaler ADC and Citrix NetScaler Gateway. This flaw arises from inconsistent request boundary parsing between NetScaler appliances and backend web servers, allowing remote, unauthenticated attackers to bypass security boundaries, access restricted resources, or hijack active user sessions on multiplexed TCP connections.\n\n## TL;DR\nUnauthenticated HTTP request smuggling in Citrix NetScaler allows session hijacking, policy bypass, and cache poisoning due to boundary parsing differences.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Exploit Status**: None/Theoretical (No public PoC code)\n- **CISA KEV Status**: Not Listed (Related CVEs CVE-2026-88771/2 are listed)\n- **Primary Impact**: Session Hijacking, Security Bypass, Cache Poisoning\n\n## Affected Systems\n\n- Citrix NetScaler ADC (Standard/Enterprise/Platinum)\n- Citrix NetScaler Gateway\n- Citrix NetScaler ADC FIPS\n- Citrix NetScaler ADC NDcPP\n\n## Mitigation\n\n- Upgrade firmware to the latest secure version (14.1-73.37 / 13.1-64.24 or later)\n- Disable TCP multiplexing and keep-alive settings on downstream web servers to prevent socket reuse\n- Configure Web Application Firewalls (WAF) to detect and block contradictory Content-Length and Transfer-Encoding headers\n- Enable Enhanced ISN Generation to mitigate related TCP prediction attacks\n\n**Remediation Steps:**\n1. Identify vulnerable NetScaler appliances and execute configuration checks for active HTTP/SSL virtual servers.\n2. Download the appropriate secure firmware build (14.1-73.37 or 13.1-64.24) from the official Citrix portal.\n3. Apply the firmware update to both standalone nodes or in high-availability (HA) pairs sequentially.\n4. Execute CLI commands on all partitions to enable Enhanced ISN Generation: 'set ns tcpparam -enhancedISNgeneration ENABLED'.\n5. Save the active configuration locally via 'save ns config -all' and reboot the appliance if required.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88773) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T07:30:30.000000Z"}