CVE-2026-88773
HTTP Request Smuggling
- Published
- Sep 27, 2026
- Updated
- Sep 29, 2026
- Assigning CNA
- NetScaler
- Evidence observed
- Nov 1, 2026
Primary CVSS
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLow · next 30 days
- Percentile
- 88.7%
- Model date
- Oct 31, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
Sources
modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb
Metasploit Framework modulesDeclared conditions
- platform: Unix($.exploit_freebsd/http/citrix_netscaler_cve_2026_88771.platform)
- verification: check_declared($.exploit_freebsd/http/citrix_netscaler_cve_2026_88771.check)
Technical analysis of a NetScaler nsppe HTTP/1.1 chunk-size integer-wrap request smuggling flaw, with disassembly, wire-level PoC flows, and firmware patch diff.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.