Oversized DTLS handshake record to NetScaler Gateway (CVE-2026-88772)

Ibrahim Saud@tektrix

•updated Sep 28, 2026•5•0•24

Detects an attempt to exploit CVE-2026-88772 by identifying an oversized DTLS handshake record on a NetScaler Gateway. The rule looks for UDP traffic on port 443 where the initial handshake record exceeds the expected size threshold, indicative of a potential buffer overflow attempt.