Citrix Net Scaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Summary: Researchers at watchTowr disclosed technical details of CVE-2026-88772, a CVSS 9.5 memory overflow in Citrix NetScaler ADC and Gateway's DTLS handling within the NetScaler Packet Processing Engine, which CISA says could allow remote code execution or denial-of-service. The flaw stems from NetScaler trusting the DTLS handshake header's 1-byte fragment_length field while the length field claims a 120-byte message, letting 120 fragments reassemble into an NSB chain of about 174 KB that overflows a 35,840-byte scratch buffer, and watchTowr found the overflow can redirect control flow to arbitrary shellcode with root privileges via mprotect() to defeat NX protections.
Why it matters: A pre-auth path to root-level shellcode in an internet-facing NetScaler appliance, actively exploited alongside CVE-2026-88771, means the patch window is the only thing standing between an attacker and your gateway.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-88771CVE-2026-88772
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026