Second Citrix NetScaler Zero-Day Exposes VPN Servers Through a Default DTLS Setting

Citrix has fixed eight vulnerabilities in a single security bulletin, CTX697096, and watchTowr Labs says the advisory included not one but two flaws already exploited in the wild. The second, CVE-2026-88772, is a memory overflow in the DTLS feature of NetScaler, and it was used as a zero-day, meaning attackers had it before a fix existed.

NetScaler is an application delivery controller. It sits in front of an organisation's applications and handles load balancing, traffic management and encryption. NetScaler Gateway adds VPN and secure remote access. Devices like this are meant to be hardened and tougher to break into than a typical server, yet they concentrate access at a single chokepoint, which makes them an attractive target when something goes wrong.

According to watchTowr, the flaw requires DTLS to be enabled. That is the default on VPN virtual servers unless an administrator has explicitly turned it off with the setting -dtls OFF. DTLS is TLS adapted to run over UDP. The researchers' write-up begins with the basics of how DTLS records are structured, ahead of a deeper technical walk-through. This summary draws only on the opening of that article, and the Citrix advisory lists the specific fixed versions to apply.