CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation
Citrix NetScaler ADC and Gateway devices are under active exploitation through CVE-2026-88772, a critical memory overflow vulnerability in DTLS protocol handling that allows pre-authentication remote code execution. Attackers exploit parsing inconsistencies in the fragment_length field to craft malicious records that appear small but contain oversized data, causing buffer overflows that can be weaponized for arbitrary shellcode execution with root privileges. The vulnerability affects the NetScaler Packet Processing Engine and has been added to CISA's Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. This incident highlights the continued targeting of network infrastructure devices, particularly load balancers and VPN gateways that sit at critical network perimeters. With organizations increasingly dependent on hybrid connectivity and secure remote access, vulnerabilities in these edge devices represent high-value targets for threat actors seeking initial network compromise and lateral movement capabilities.
Kill Chain
