CVE-2026-88772: Citrix NetScaler ADC/Gateway DTLS Pre-Auth Memory Overflow (KEV)

CVE-2026-88772 is a pre-authentication memory overflow in Citrix NetScaler ADC and Gateway's DTLS handshake reassembly that leads to remote code execution or denial of service on any virtual server with DTLS enabled (the default for VPN virtual servers), and Citrix confirms it has been exploited in the wild as a zero-day alongside the companion flaw CVE-2026-88771.

CVE-2026-88772 is a memory-buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway. NVD's description states the issue affects ADC releases "before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP" and Gateway releases "before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service" (NVD).

NVD lists the CVE as "Analyzed" with an NVD Primary CVSS v3.1 base score of 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, alongside a Secondary CVSS v4.0 score of 9.5 (critical) submitted by Citrix; the 9.5 figure commonly quoted for this CVE is Citrix's v4.0 Secondary score, not NVD's own v3.1 Primary assessment, which is lower (NVD).

Citrix's security bulletin CTX697096 states the precondition for exploitability is "DTLS configuration enabled on NetScaler ADC or NetScaler Gateway," adding the note that DTLS is "enabled by default on VPN vServer." Citrix recommends upgrading to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS or 13.1-37.279 FIPS/NDcPP or later, and documents a configuration mitigation of explicitly disabling DTLS on VPN virtual servers with -dtls OFF for appliances that cannot be patched immediately. The bulletin states plainly: "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed" (Citrix Security Bulletin CTX697096).

Security researchers at watchTowr published a technical analysis describing the root cause as a DTLS fragment-reassembly mismatch: the vulnerable code "uses length=120 to find the hidden header, but it uses fragment_length=1 when rebuilding message_seq=2," and an attacker who completes the DTLS cookie exchange can then send about 120 malicious records that get reassembled into roughly 173,652 bytes of data copied into a fixed 35,840-byte scratch buffer — an overflow of about 137,825 bytes. watchTowr's advisory table marks in-the-wild exploitation status as confirmed, consistent with Citrix's own statement (watchTowr Labs).

CISA added CVE-2026-88772 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-27, the same day as the Citrix bulletin, with a required-action due date of 2026-09-30, and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.7816 (99.6th percentile), consistent with confirmed in-the-wild zero-day use against a widely deployed network-edge product — Shadowserver counted more than 23,000 internet-exposed NetScaler IP addresses around the time of disclosure (FIRST EPSS).

Any NetScaler ADC or Gateway appliance on an affected build, especially one with DTLS enabled on a VPN virtual server by default, should be patched to the fixed release immediately; where patching must wait, disabling DTLS with -dtls OFF closes the attack path but does not remove the underlying flaw, and appliances exposed before mitigation should be checked against Citrix's indicators of compromise.

• Memory buffer overflow in NetScaler ADC (before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1.37.279 FIPS/NDcPP) and NetScaler Gateway (before 14.1-73.37, 13.1-64.23) leading to remote code execution or denial of service. — NVD
• NVD status Analyzed; NVD Primary CVSS v3.1 base score 8.1, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; Citrix's Secondary CVSS v4.0 score is 9.5 — the commonly quoted figure is Citrix's, not NVD's own v3.1 Primary score. — NVD
• Exploitability requires DTLS enabled (default on VPN vServer); fixed in 14.1-73.37 / 13.1-64.23 / FIPS and NDcPP equivalents; mitigation is '-dtls OFF'; "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." — Citrix Security Bulletin CTX697096
• Root cause is a DTLS fragment-reassembly length mismatch causing a ~137,825-byte overflow of a 35,840-byte scratch buffer; in-the-wild exploitation confirmed. — watchTowr Labs
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-27, required-action due date 2026-09-30, ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.7816 (99.6th percentile) as of 2026-10-28. — FIRST EPSS