CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.
CVE-2019-1068 (CVSS 8.8, CWE-20) is an improper input validation flaw allowing unauthenticated RCE in Microsoft SQL Server 2014 SP2/SP3, 2016, and 2017 on 32-bit and x64 builds. Exploitation requires low complexity and low privileges with no user interaction, and CISA formally added it to the KEV catalog on August 26, 2026. The CVE was originally published on July 15, 2019 and carries an EPSS score of 52.8%. Administrators must inventory affected SQL Server assets and apply vendor patches on an accelerated timeline.
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
CISA added six flaws, including actively exploited CVE-2026-8452 in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog with federal patch deadlines.
CISA added six vulnerabilities to its KEV catalog: CVE-2015-3246 and CVE-2015-5287 (Red Hat libuser race condition and ABRT privilege escalation), CVE-2019-1068 (Microsoft SQL Server RCE), CVE-2021-23758 (Ajax.NET Professional deserialization), CVE-2022-0995 (Linux Kernel out-of-bounds write) and CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer flaw). CVE-2026-8452 has been observed under active exploitation in the wild and can cause denial-of-service. Under BOD 22-01, federal civilian agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.
CISA warns attackers are exploiting CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, to run malicious commands on database servers.
CISA warned that CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, is being exploited in active attacks. Successful exploitation allows an attacker to execute malicious commands on a vulnerable database server, with access limited to the privileges of the SQL Server service account. The warning signals active exploitation of a long-known flaw and makes patching a priority for organizations running affected SQL Server deployments.
CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.
CISA added six flaws to the KEV catalog on August 27, 2026, citing evidence of active exploitation, led by CVE-2026-8452, an improper buffer restriction in Citrix NetScaler ADC and Gateway that can cause denial-of-service. Defused Cyber and Previdian reported active exploitation of CVE-2026-8452, with 36 attempts over 12 days from 12 attacker IPs deploying web shells x.php and z.php. The other additions cover SQL Server RCE (CVE-2019-1068), Linux kernel out-of-bounds write (CVE-2022-0995), Red Hat ABRT and libuser privilege escalations (CVE-2015-5287, CVE-2015-3246), and AjaxPro deserialization RCE (CVE-2021-23758). FCEB agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.
Remote Code Execution in Microsoft SQL Server 2016 and 2017
CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server caused by improper handling of the processing of internal functions (CWE-20, improper input validation). An attacker who can reach SQL Server over the network with low-privileged credentials can trigger the flawed code path and execute arbitrary code, gaining high confidentiality, integrity, and availability impact on the database host. Any organization running affected Microsoft SQL Server versions — including SQL Server 2016 and SQL Server 2017 — is affected. The flaw carries a high EPSS score (52.8% probability of exploitation within 30 days, 99th percentile) and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, with headlines reporting it being exploited in active attacks. No public proof-of-concept is known, but the in-the-wild exploitation documented by CISA makes patching urgent; the fix shipped in Microsoft's July 2019 Patch Tuesday security updates.
· Microsoft SQL Server · microsoft SQL Server 2016 KEVmass
Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
Ajax.NET Professional (distributed as the ajaxpro.2 package) is vulnerable to insecure deserialization (CWE-502): it deserializes arbitrary .NET classes supplied by the client without validating which types may be instantiated. Because AjaxPro exposes HTTP endpoints for browser-to-server AJAX calls, a remote, unauthenticated attacker can send a crafted serialized payload to any reachable AjaxPro endpoint and abuse .NET deserialization gadget chains to execute code on the server. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score of 9.8, network vector, no privileges or user interaction required). Any application running any version of ajaxpro.2 / Ajax.NET Professional is affected; the provided data specifies no fixed version, so defenders must rely on vendor guidance for patched releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, carries an EPSS 30-day exploitation probability of 83.6%, has public PoC code available, and Talos Intelligence reporting links it to the Chinese-speaking threat actor UAT-10147, which deploys the SPECTRE malware with an EDR bypass and a Linux rootkit in post-compromise operations.
· michaelschwarz (ajaxpro.2 project) ajaxpro.2 (package) All versions are vulnerable; no fixed version specified in the provided data · michaelschwarz Ajax.NET Professional All versions are vulnerable; no fixed version specified in the provided data KEV PoC ×2
Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild
CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed.
Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
CVE-2022-0995 is an out-of-bounds (OOB) memory write in the Linux kernel's watch_queue event notification subsystem (CWE-787) that can overwrite parts of kernel state. A local user can trigger it through the watch_queue interface, for example by supplying a crafted event filter definition, causing the kernel to write beyond allocated memory when event notifications are processed. Successful exploitation may allow the local user to gain privileged (kernel/root) access or crash the system, yielding high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector). Affected systems include mainstream Linux kernels (Fedora is explicitly listed) and NetApp HCI appliance firmware products that ship the affected kernel. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, two public proof-of-concepts are available, and EPSS puts 30-day exploitation probability at 9.5% (95th percentile), though ransomware use is unconfirmed.
· Linux kernel Kernels shipping the watch_queue event notification subsystem prior to patched/upstream fixes (see distribution advisories for exact affected and fixed versions · Fedora Project Fedora Fedora releases with affected kernel packages prior to the issued kernel updates (see Fedora/Red Hat advisories) KEV PoC ×2mass
Local Privilege Escalation via Symlink Attack in Red Hat ABRT
CVE-2015-5287 is a privilege escalation flaw in Red Hat's Automatic Bug Reporting Tool (ABRT) in which a local user with certain permissions can gain elevated privileges via a symlink attack against a file with a predictable name. Exploitation requires local access to an affected system; an attacker who triggers the flawed file-handling behavior can elevate their privileges on that machine. It affects deployments running ABRT, which ships by default with Red Hat Enterprise Linux and related distributions, including systems that may now be end-of-life or end-of-service. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-26, indicating exploitation has been observed in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS estimates a 5.0% probability of exploitation within 30 days (92nd percentile).
· Red Hat Automatic Bug Reporting Tool (ABRT) KEVmass
Race Condition in Red Hat libuser Allows Local Privilege Escalation
CVE-2015-3246 is a race condition in Red Hat's libuser, the user-management library used by utilities that modify system accounts, that can cause corruption of the /etc/passwd file during concurrent account updates. An authenticated local user who triggers the race — typically by racing account-modification operations against one another — can desynchronize or corrupt the passwd file. Successful exploitation yields either a denial-of-service condition on the host or, in the privilege-escalation case, elevated (root-level) access by manipulating entries in /etc/passwd. Any Red Hat system shipping the vulnerable libuser library is affected, with risk concentrated on multi-user servers where untrusted local accounts exist. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, indicating it is being exploited in the wild, and EPSS assigns it an 8.8% probability of exploitation within 30 days (95th percentile); ransomware use is unknown and no public proof-of-concept is cataloged.
· Red Hat libuser Affected versions not enumerated in the source data; applies to libuser as shipped with Red Hat distributions and remediated via Red Hat security updates KEVmass
Unauthenticated RCE Chain in IBM Langflow OSS 1.0.0-1.10.0
IBM Langflow OSS 1.0.0 through 1.10.0 contains an unauthenticated code-injection flaw (CWE-94) that can be chained into full remote code execution. An attacker with network access first calls /api/v1/auto_login, which mints a SUPERUSER token to any caller without authentication, then calls /api/v1/validate/code, which executes attacker-supplied code via exec() on the Langflow host. Successful exploitation yields full control of the affected deployment, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, network-exploitable with no privileges or user interaction required). Anyone running IBM Langflow OSS 1.0.0-1.10.0 is affected, especially default deployments reachable from untrusted networks. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-04, confirming active exploitation; EPSS estimates a 60.6% probability of exploitation within 30 days (99th percentile), and ransomware use is unknown.
· IBM Langflow OSS 1.0.0 through 1.10.0 (inclusive) KEVlarge
Actively Exploited Browser-Based RCE in Ray AI Compute Engine
Ray, the open-source AI compute engine, is vulnerable to a critical remote code execution flaw (CVE-2025-62593, CWE-94/CWE-352) in versions prior to 2.52.0, caused by an insufficient guard against browser-based attacks: the software distinguishes browser traffic only by checking that the User-Agent header starts with 'Mozilla', but the fetch specification allows that header to be modified. An attacker can combine DNS rebinding with a crafted User-Agent so that a developer's Firefox or Safari browser silently sends malicious requests to locally running Ray services after the developer visits an attacker-controlled website or is served a malicious advertisement (malvertising). Successful exploitation yields full remote code execution on the machine running Ray, with high confidentiality, integrity and availability impact reflected in the CVSS 4.0 score of 9.4. Affected users are developers running Ray as a development tool on any version before 2.52.0, which is the fixed release. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-17, a public proof of concept is available in the project's GitHub security advisory (GHSA-q279-jhrf-cc6v), and EPSS estimates a 16.9% probability of exploitation in the next 30 days.
· Ray-Project (Anyscale) Ray All versions prior to 2.52.0 (patched in 2.52.0) KEV PoC large
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
CVE-2026-82078 is an unsafe dynamic class loading flaw (unsafe reflection, CWE-470) in the database connection utilities of PaperCut NG and PaperCut MF: the software instantiates a database driver class based on a configurable driver name without validating it against an allowlist of approved drivers. An attacker who can manipulate system configuration parameters can point that setting at classes of their choosing, causing the server to execute arbitrary Java bytecode residing on the application classpath in the security context of the PaperCut server process. On its own the issue is rated 9.4 (Critical) with high privileges required, but when chained with the companion authentication bypass CVE-2026-81578 it yields unauthenticated remote code execution on the print-management server. All PaperCut NG and MF deployments are in scope; affected version ranges were not specified in the available data, so administrators should consult PaperCut's advisory for fixed versions. The flaw is confirmed exploited in the wild as a zero-day: it was added to CISA's KEV catalog on 2026-08-31, and public reporting describes an AI-orchestrated campaign that compromised PaperCut servers at roughly 395 organizations (~440 servers), with EPSS currently at 1.7% (76th percentile).
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and…
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.