Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
watchTowr dissects CVE-2026-88772, an in-the-wild-exploited pre-auth DTLS memory overflow in Citrix NetScaler enabling RCE, one of eight fixed flaws.
CVE-2026-88772 is a DTLS memory overflow in Citrix NetScaler ADC/Gateway (CVSS 4.0 9.5) that can lead to unauthenticated remote code execution when DTLS is enabled, which is the default for VPN virtual servers unless -dtls OFF is set. Citrix confirms it was exploited in the wild as a zero-day. It is one of eight vulnerabilities fixed in bulletin CTX697096, alongside CVE-2026-88771, an also-exploited unauthenticated arbitrary command execution flaw. Fixed versions include 14.1-73.37 and 13.1-64.23 and later releases.
- Pre-auth DTLS memory overflow enables RCE; DTLS is default on VPN virtual servers
- Exploited in the wild as a zero-day; CVSS 4.0 score 9.5 Critical
- One of eight flaws fixed in Citrix bulletin CTX697096
- Includes CVE-2026-88771, a default-config unauthenticated command execution flaw
- Upgrade to 14.1-73.37 or 13.1-64.23 and later to remediate
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Organizations
- CitrixNetScalerCloud Software GroupwatchTowr Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
12 min read at labs.watchtowr.com
What Is A Citrix NetScaler? NetScaler, from Citrix (now under Cloud Software Group), is an application delivery controller - some believe it qualifies to be described a sa security appliance. It sits in front of an organization's applications and handles load balancing, traffic management, and SSL/TLS termination.
By Sina Kheirkhah (@SinSinology) · labs.watchtowr.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.