U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added six flaws, including actively exploited CVE-2026-8452 in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog with federal patch deadlines.
CISA added six vulnerabilities to its KEV catalog: CVE-2015-3246 and CVE-2015-5287 (Red Hat libuser race condition and ABRT privilege escalation), CVE-2019-1068 (Microsoft SQL Server RCE), CVE-2021-23758 (Ajax.NET Professional deserialization), CVE-2022-0995 (Linux Kernel out-of-bounds write) and CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer flaw). CVE-2026-8452 has been observed under active exploitation in the wild and can cause denial-of-service. Under BOD 22-01, federal civilian agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.
- CVE-2026-8452 in Citrix NetScaler ADC and Gateway observed under active exploitation
- Batch spans legacy flaws: Red Hat libuser/ABRT (2015), SQL Server RCE (2019), Linux kernel OOB write (2022)
- Federal agencies must patch the SQL Server and NetScaler flaws by August 29, 2026
- Remaining additions due September 9, 2026 under Binding Operational Directive 22-01
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-3246 | Race Condition in Red Hat libuser Allows Local Privilege Escalation | 7.4 | 9% | KEVPoC | KEV |
| CVE-2015-5287 | Local Privilege Escalation via Symlink Attack in Red Hat ABRT | — | 5% | KEV | — KEV |
| CVE-2019-1068 | Remote Code Execution in Microsoft SQL Server 2016 and 2017 | 8.8 | 57% | KEV | KEV |
| CVE-2021-23758 | Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2) | 9.8 | 83% | KEVPoC ×2 | KEV |
| CVE-2022-0995 | Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation | 7.8 | 9% | KEVPoC ×2 | KEV |
| CVE-2026-8452 | Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild | 8.8 | 1% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ajax.net | tructure Security Agency (CISA) adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler fl |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Red Hat, Linux Kernel, Ajax.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.