CVE-2026-88773: HTTP Smuggling in NetScaler ADC

CVE-2026-88773 is an inconsistent HTTP request interpretation vulnerability in Citrix NetScaler's frontend component that manages access and gateway traffic to enterprise infrastructure. The flaw in the nsppe (NetScaler packet processing engine) involves incorrect 32-bit chunk-size accumulation, enabling attackers to bypass security controls and intermediate proxies through HTTP Request Smuggling. This directly impacts ADC (Application Delivery Controller) and Gateway, critical perimeter security systems for enterprise organizations.

The vulnerability achieves a maximum CVSS score of 10.0 and is classified as critical by authorities. Although announced on September 27, 2026 by NIST, as of November 2026 public signals appear on GitHub of repositories claiming to contain functional exploits. This combination of maximum severity score and declared availability of attack code indicates imminent risk of active exploitation in the real threat landscape.

System administrators must immediately inventory all NetScaler ADC and Gateway instances in use, verify specific version numbers, and prioritize upgrades to the indicated fix versions. No workaround alternative to patching is reported: updating is the only definitive mitigation. In the short term, enable verbose logging for malformed HTTP requests, monitor access logs for smuggling anomalies, and consider additional WAF rules to block suspicious chunk-sizes until patching is completed.