Affected Systems

Citrix NetScaler ADC and NetScaler Gateway (vulnerable versions not specified in advisory). Affects the NetScaler Packet Processing Engine (NSPPE) DTLS protocol handler. Pre-authentication attack surface.

Exploitation Status

Actively exploited in the wild. Proof-of-concept code publicly available from watchTowr. Exploitation confirmed by CISA and vendor advisories.

Business Impact

Unauthenticated remote attackers can achieve root-level code execution on internet-facing NetScaler ADC and Gateway appliances without credentials. DTLS memory overflow allows shellcode injection via crafted handshake fragments. Attackers can bypass NX protections using mprotect() system calls. High likelihood of mass exploitation given public PoC, active exploitation, and prevalence of NetScaler in enterprise perimeters. Often chained with CVE-2026-88771 in attacks.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Citrix security patches for CVE-2026-88772 immediately on all NetScaler ADC and Gateway appliances
  • Isolate unpatched NetScaler instances from internet exposure or place behind additional firewall rules restricting DTLS traffic until patched
  • Hunt for indicators of compromise: review NetScaler logs for anomalous DTLS handshake traffic, unusual process execution, or unexpected outbound connections from appliances since initial disclosure
  • Verify patch application by checking NetScaler firmware version against Citrix advisory and confirming DTLS handler version in NSPPE
  • Monitor CISA KEV catalog and threat intelligence feeds for IOCs associated with CVE-2026-88772 and CVE-2026-88771 exploitation chains