Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
Reported exploitedCitrix NetScaler ADCCitrix NetScaler GatewayOur summary
watchTowr Labs has detailed a second zero-day from Citrix's latest NetScaler bulletin, CVE-2026-88772, which sits alongside the command-injection flaw CVE-2026-88771 disclosed in the same CTX697096 advisory covering eight bugs in total. This issue is a preauthentication memory overflow in the DTLS handling of NetScaler ADC and NetScaler Gateway, triggered when an attacker sends crafted DTLS handshake fragments that abuse inconsistent length fields to smuggle roughly 174KB of data into a fixed 35,840-byte scratch buffer inside the nsppe process. Because DTLS is enabled by default on VPN virtual servers, no authentication is required, and Citrix confirms the bug (CVSS 9.5) has already been exploited as a zero-day, researchers managed to turn the overflow into full remote code execution via a ROP chain and mprotect call. Citrix, now under Cloud Software Group, urges customers to upgrade to NetScaler 14.1-73.37, 13.1-64.23, or the corresponding FIPS/NDcPP builds without delay.
Below is the opening; the full story is at watchTowr Labs.
From watchTowr Labs
This research is a glimpse into the capability powering the watchTowr Platform, a Preemptive Exposure Management solution. We enable organizations to autonomously validate and mitigate their exposure to emerging threats, ahead of in-the-wild exploitation.
Request a demo
Part 1 of this week's saga can be found here.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.