WHIPSHOT/SLAPSHOT NetScaler DTLS Handshake Failure + NSPPE Crash (CVE-2026-88772

Georgios Maragos@Gmarak

•updated 27 days ago•3•0•11

Detects an SSL_HANDSHAKE_FAILURE syslog event on a Citrix NetScaler appliance characterized by a DTLSv1.0 client version and a 'Handshake failure-Internal Error' reason. This pattern is indicative of exploitation attempts against CVE-2026-88772, specifically associated with the WHIPSHOT/SLAPSHOT campaign. This is a high-sensitivity precursor signal that should be correlated with system crash events on the appliance for increased confidence.