🛡️ CVE-2026-88772

The items that name it 15

• This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
  articleas classification.key entities2026-10-27
• Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
  articleas cves2026-10-19
• Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
  advisoryas cves2026-10-09

  NetScaler zero-day leading to RCE or DoS, patched a week before CVE-2026-107406, exploited in attacks against government, financial services, education, legal, and professional services organizations

• Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771
  writeupas cves2026-10-07
• CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD
  writeupas cves2026-10-06

  Memory overflow leading to RCE or DoS (DTLS/UDP buffer flaw) in Citrix NetScaler ADC/Gateway. Exploited in the wild. Can be targeted over UDP to run code or crash the system.

• Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
  advisoryas cves2026-09-30It is written here as CVE-2026-88772: memory overflow in the DTLS configuration on NetScaler ADC and NetScaler Gateway, can lead to RCE or denial of service (DoS); exploited in the wild; CVSS v4.0 base score 9.5.
• Critical Citrix NetScaler Zero-Days Under Active Exploitation
  advisoryas cves2026-09-29
• Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
  writeupas classification.key entities2026-09-29
• Citrix NetScaler CVE-2026-88772 — DTLS preauth memory overflow
  writeupas cves2026-09-29

  DTLS preauth memory overflow in Citrix NetScaler ADC/Gateway nsppe binary; exploited in the wild as a zero-day; requires DTLS enabled (default on VPN virtual servers unless -dtls OFF is set); one of eight vulnerabilities fixed in Citrix advisory CTX697096.

• Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
  writeupas cves2026-09-28

  Referenced alongside CVE-2026-88771 as one of the Citrix NetScaler zero-day vulnerabilities covered in watchTowr's high-level analysis and FAQ pages; not analyzed in technical depth in this article.

• Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
  advisoryas cves2026-09-28

  Critical memory corruption vulnerability in NetScaler ADC and Gateway, CVSSv4 score 9.5, requires the DTLS feature to be enabled, high attack complexity, confirmed actively exploited in the wild as a zero-day prior to vendor disclosure on September 27, 2026, added to CISA KEV catalog on September 27

• watchTowr: CVE-2026-88771 Citrix NetScaler ADC/Gateway unauthenticated RCE
  advisoryas cves2026-09-27

  Memory overflow vulnerability in Citrix NetScaler ADC/Gateway that can lead to remote code execution or denial of service when DTLS is enabled; DTLS is on by default for VPN virtual servers

• Critical FortiMail Zero-Day Flaw (CVE-2026-104286)
  advisoryas cves

  Citrix NetScaler ADC and NetScaler Gateway security flaw under in-the-wild exploitation (details not given).

• Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
  advisoryas cves
• Known Exploited Vulnerabilities Catalog | CISA
  otheras cvesIt is written here as CVE-2026-88772 (Citrix NetScaler ADC and Gateway improper input validation; added 2026-09-27, due 2026-09-30; bulletin covers CVE-2026-88771 through CVE-2026-88778).

  Citrix NetScaler ADC and Gateway improper input validation; added 2026-09-27, due 2026-09-30; bulletin covers CVE-2026-88771 through CVE-2026-88778