Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution

Security researchers at watchTowr have published a detailed technical breakdown of CVE-2026-88772, a critical flaw affecting Citrix NetScaler ADC and NetScaler Gateway that attackers are already exploiting in the wild. The bug stems from how the NetScaler Packet Processing Engine handles DTLS handshake reassembly: it trusts a tiny declared fragment size while the overall message length field claims a much larger total, letting an attacker craft fragmented records that overflow a fixed 35,840-byte scratch buffer with up to roughly 174 KB of data. According to researcher Sina Kheirkhah, this overflow can be chained with an mprotect() call to bypass NX protections and redirect execution to attacker-controlled shellcode with root privileges, all without authentication. The disclosure follows closely on the heels of a related PoC for CVE-2026-88771, which has reportedly been used together with CVE-2026-88772 in active attack campaigns, underscoring the urgency for Citrix customers to apply available patches immediately.