company

watchTowr Labs

Security research firm whose published research chained the heap corruption into shellcode execution inside nsppe as root and a SUID /bin/sh web shell path.

Current clusters

security1 publisher

Attackers are exploiting a NetScaler DTLS memory overflow before authentication

Citrix patched CVE-2026-88772, a pre-authentication DTLS memory overflow in NetScaler that attackers are already exploiting as a zero-day. DTLS ships enabled on VPN virtual servers, so a Gateway is exposed unless it was deliberately disabled.

Publishers:labs.watchtowr.com

Reality

Evidence62
Adoption: Insufficient
Hype gap+8
Incentives: Insufficient
Confidence58

build1 publisher

One unauthenticated SAML request reaches root on NetScaler before signature verification runs

The overflow in CVE-2026-8452 sits in PrefixList canonicalization, which NetScaler performs before it validates the SAML signature, so an attacker needs no trust with your IdP and only a reachable virtual server with SAML turned on.

Publishers:dev.to

Reality

Evidence56
Adoption63
Hype gap−8
Incentives44
Confidence55