NetScaler VPN DTLS Flood Preceding Crash Logs (CVE-2026-88772)

Ibrahim Saud@tektrix

•updated Sep 28, 2026•3•0•10

Detects high volumes of DTLS/UDP session-initiation traffic targeting NetScaler VPN virtual servers that are immediately followed by appliance-level error logs or crashes. This behavior is indicative of active probing or exploitation attempts, such as those associated with CVE-2026-88772, where malicious payloads cause service instability.