Citrix NetScaler flaw allows shellcode execution

Researchers disclosed technical details of CVE-2026-88772 in Citrix NetScaler ADC and Gateway. The issue had been described as a memory overflow in DTLS handling inside the NetScaler Packet Processing Engine.

CISA said the products had an improper restriction of operations within a memory buffer that could allow remote code execution or denial of service. watchTowr said NetScaler relied on DTLS fragment fields during reassembly even when the wider message length did not match.

The company said that mismatch could let an attacker make a record seem smaller than the data copied into memory. It said packets were stored in NetScaler Buffers and then combined into a 35,840-byte scratch buffer, which the vulnerable version did not check against.

Sina Kheirkhah said a 120-byte handshake could be split across 120 fragments and still be treated as complete. watchTowr said the overflow could be turned into arbitrary shellcode execution with root privileges by using mprotect() to bypass NX protections.

The disclosure followed a proof of concept for CVE-2026-88771 that watchTowr had released a day earlier. The article said that flaw had been used together with CVE-2026-88772 in real-world attacks.