CVE-2026-88773: CVE-2026-88773: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerabi…
citrix · netscaler application delivery controller · NVD published 2026-09-27 · posted 2026-09-27 · last modified 2026-09-29
What it is
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
| Weakness | CWE-444 |
|---|---|
| CVSS vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5) |
| ATT&CK tactics | n/a |
Step-by-step fix guide: How to fix CVE-2026-88773: citrix netscaler application delivery controller (Metasploit module public)
Exploitation evidence
First exploit evidence seen: 2026-09-27 (earliest date across the sources below).
Exploited in the wild
No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).
Public exploit code
Metasploit
exploit/freebsd/http/citrix_netscaler_cve_2026_88771: Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771) (disclosure 2026-09-27)
GitHub proof-of-concept repositories below quality bar
2 public repositories from 2 accounts, first seen 2026-10-02.
Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.
Sources: Rapid7 Metasploit Framework module metadata · nomi-sec/PoC-in-GitHub.
No ATT&CK techniques could be mapped or inferred for this CVE yet.
How to fix it
Fixed versions
- citrix netscaler application delivery controller: upgrade to 13.1-64.23 or later (affected from 13.1)
- citrix netscaler application delivery controller: upgrade to 13.1.37.279 or later (affected from 13.1)
- citrix netscaler application delivery controller: upgrade to 14.1-73.37 or later (affected from 14.1)
- citrix netscaler gateway: upgrade to 13.1-64.23 or later (affected from 13.1)
- citrix netscaler gateway: upgrade to 14.1-73.37 or later (affected from 14.1)
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
Detection Generic guidance
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.