CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.
CISA added six flaws to the KEV catalog on August 27, 2026, citing evidence of active exploitation, led by CVE-2026-8452, an improper buffer restriction in Citrix NetScaler ADC and Gateway that can cause denial-of-service. Defused Cyber and Previdian reported active exploitation of CVE-2026-8452, with 36 attempts over 12 days from 12 attacker IPs deploying web shells x.php and z.php. The other additions cover SQL Server RCE (CVE-2019-1068), Linux kernel out-of-bounds write (CVE-2022-0995), Red Hat ABRT and libuser privilege escalations (CVE-2015-5287, CVE-2015-3246), and AjaxPro deserialization RCE (CVE-2021-23758). FCEB agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.
- Six flaws added to KEV including Citrix NetScaler CVE-2026-8452 under active exploitation.
- Previdian observed 36 exploitation attempts deploying web shells x.php and z.php over 12 days.
- FCEB agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026.
- KEV additions follow Cisco Talos report on UAT-10147 targeting Windows and Linux web servers.
- CISA review found injection flaws dominated 2024-2025 CVE records.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-3246 | Race Condition in Red Hat libuser Allows Local Privilege Escalation | 7.4 | 9% | KEVPoC | KEV |
| CVE-2015-5287 | Local Privilege Escalation via Symlink Attack in Red Hat ABRT | — | 5% | KEV | — KEV |
| CVE-2019-1068 | Remote Code Execution in Microsoft SQL Server 2016 and 2017 | 8.8 | 57% | KEV | KEV |
| CVE-2021-23758 | Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2) | 9.8 | 83% | KEVPoC ×2 | KEV |
| CVE-2022-0995 | Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation | 7.8 | 9% | KEVPoC ×2 | KEV |
| CVE-2026-8452 | Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild | 8.8 | 1% | KEVPoC | KEV |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 27, 2026 Vulnerability / Web Security The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.