Citrix NetScaler DTLS Flaw Can Enable Root-Level Shellcode Execution

Summary

Researchers describe how a DTLS fragment-length parsing flaw in Citrix NetScaler ADC and Gateway can cause a buffer overflow. The flaw is reportedly under active exploitation and can enable remote code execution or denial of service.

Key points

CVE-2026-88772 affects Citrix NetScaler ADC and Gateway and is described as a critical DTLS-related memory overflow in the NetScaler Packet Processing Engine.
The flaw stems from inconsistent handling of the DTLS fragment_length and message length fields, allowing crafted records to cause data to exceed a scratch buffer.
CISA said the vulnerability could allow remote code execution or denial of service; the article reports active exploitation in the wild.
watchTowr found the overflow could be used to divert control flow to arbitrary shellcode with root-level privileges, using mprotect() to defeat NX protections.
The vulnerability has been patched, according to the article. It also says CVE-2026-88771 was abused alongside CVE-2026-88772 in real-world attacks.

Article Details

Attack Vectors: An attacker can send crafted DTLS records that exploit inconsistent parsing of fragment_length and message length, causing a buffer overflow in the NetScaler Packet Processing Engine.
The overflow can reportedly be weaponized to redirect control flow to shellcode with root-level privileges; the article says mprotect() can be used to defeat NX protections.
Defensive Notes: The article reports that the flaw has been patched but does not provide affected or fixed versions.
The article reports active exploitation in the wild.