U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added six flaws, including actively exploited CVE-2026-8452 in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog with federal patch deadlines.
CISA added six vulnerabilities to its KEV catalog: CVE-2015-3246 and CVE-2015-5287 (Red Hat libuser race condition and ABRT privilege escalation), CVE-2019-1068 (Microsoft SQL Server RCE), CVE-2021-23758 (Ajax.NET Professional deserialization), CVE-2022-0995 (Linux Kernel out-of-bounds write) and CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer flaw). CVE-2026-8452 has been observed under active exploitation in the wild and can cause denial-of-service. Under BOD 22-01, federal civilian agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.