Network edge & infrastructureCritical severity

SECURITY GUIDE

Remote Code Execution and Denial of Service in NetScaler DTLS (CVE-2026-88772)

Review how UDP packet handling errors in DTLS-enabled NetScaler gateways enable remote execution or appliance crashes.

Areas to considerNetScaler ADC with DTLSNetScaler Gateway VPNDatagram Transport Security Stack
01

THE CONTEXT

What to understand

CVE-2026-88772 targets Citrix NetScaler ADC and NetScaler Gateway deployments with Datagram Transport Layer Security (DTLS) enabled. When processing incoming UDP packets associated with DTLS tunnel negotiation, the network stack mishandles out-of-order and oversized fragment records. An attacker sending crafted DTLS handshake packets can induce buffer corruption, resulting in either a denial-of-service crash of the core gateway daemon or remote code execution.

02

HIGH-LEVEL CONCEPT

How the risk can develop

This is a conceptual overview, not a procedure for reproducing an attack.

  1. An attacker sends crafted UDP datagrams containing malformed DTLS fragment headers to the gateway.
  2. The DTLS defragmentation module performs inaccurate length calculations when reconstructing the datagram payload.
  3. A buffer overflow occurs within the packet processing memory space, corrupting control flow registers.
  4. The appliance packet engine either crashes into a continuous reboot loop or executes attacker-injected instructions.
03

WHY IT MATTERS

Potential impact

Disruption of enterprise remote-access VPN services, appliance denial of service, and potential remote control of gateway nodes.

04

BE AWARE

Signals to monitor

  • Repeated restarts of the NetScaler packet engine triggered by SIGSEGV signals.
  • High volumes of malformed UDP packets arriving on DTLS port 4433 from untrusted external IPs.
  • Sudden drops in VPN tunnel throughput and spike in appliance reboot events.
05

PUT DEFENSE FIRST

Recommended defenses

  1. 01Apply vendor hotfixes addressing the DTLS buffer reassembly flaw.
  2. 02Temporarily disable DTLS on virtual servers if immediate patching is not possible, falling back to standard TLS.
  3. 03Deploy perimeter rate limiting and deep packet inspection on UDP ports used by remote access gateways.
  4. 04Monitor gateway heartbeat metrics to rapidly detect and alert on packet engine crash loops.