NetScaler nsppe Crash-Restart Loop with DTLS Spike (CVE-2026-88772)

Ibrahim Saud@tektrix

•updated Sep 28, 2026•1•0•11

Detects repeated crashes or restarts of the Citrix NetScaler packet engine (nsppe) correlated with a concurrent spike in inbound DTLS traffic. This pattern is indicative of potential memory-overflow exploitation attempts (consistent with CVE-2026-88772) targeting the VPN virtual server functionality, leading to a Denial of Service (DoS) condition.