The newly listed vulnerabilities affect Microsoft SQL Server, Citrix NetScaler, the Linux kernel, Red Hat components and Ajax.NET. Security teams are being urged to prioritize remediation because the vulnerabilities are associated with real–world exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling that organizations should treat the affected software as an elevated remediation priority. CISA’s August 26 announcement was based on evidence that the vulnerabilities have been exploited in the wild.
The six vulnerabilities span several widely deployed technologies:
- CVE–2019–1068 – A remote–code–execution flaw in Microsoft SQL Server that can allow an attacker to run code under the SQL Server Database Engine service account.
- CVE–2026–8452 – A memory–buffer handling weakness in Citrix NetScaler ADC and NetScaler Gateway that can result in denial of service.
- CVE–2022–0995 – A Linux kernel out–of–bounds memory–write flaw that can enable local privilege escalation or denial of service.
- CVE–2015–5287 – A privilege–escalation vulnerability in Red Hat’s Automatic Bug Reporting Tool (ABRT), involving symbolic–link handling.
- CVE–2015–3246 – A race–condition issue in Red Hat libuser that can allow corruption of /etc/passwd, potentially resulting in privilege escalation or denial of service.
- CVE–2021–23758 – A deserialization vulnerability in Ajax.NET Professional that can permit remote code execution through malicious .NET classes.
The Citrix vulnerability has drawn particular attention because security researchers have observed exploitation attempts against CVE–2026–8452. Reporting cited by The Hacker News indicates that attackers deployed web shells and issued reconnaissance commands after gaining access. Previdian telemetry reportedly recorded 36 exploitation attempts from 12 IP addresses over a 12–day period, although this represents observed telemetry rather than a measurement of all attacks globally.
Four of the newly cataloged vulnerabilities: CVE–2022–0995, CVE–2015–5287, CVE–2015–3246 and CVE–2021–23758 – were also associated with activity documented by Cisco Talos involving the threat actor it tracks as UAT–10147. Talos reported that the group targets Windows and Linux web servers and uses known privilege–escalation vulnerabilities after obtaining an initial foothold.
The disclosure illustrates an important characteristic of modern vulnerability exploitation: attackers do not necessarily need newly discovered zero–days when older, unpatched vulnerabilities remain exposed. In the UAT–10147 activity documented by Talos, vulnerabilities dating back more than a decade were incorporated into attack chains alongside newer techniques.
CISA has set remediation deadlines of August 29, 2026 for CVE–2019–1068 and CVE–2026–8452 and September 9, 2026 for the remaining four vulnerabilities for Federal Civilian Executive Branch agencies. Although those deadlines specifically apply to FCEB organizations, CISA recommends that other organizations also use the KEV catalog to prioritize vulnerabilities known to be exploited.
The agency’s broader vulnerability analysis accompanying the announcement also highlights the persistent security impact of basic software weaknesses. CISA’s review of 2024 and 2025 CVE records found injection vulnerabilities to be the largest category in its dataset, while memory–safety and input–validation weaknesses appeared disproportionately among vulnerabilities that made it into the KEV catalog.
For defenders, the immediate priority is therefore straightforward: identify affected NetScaler, SQL Server, Linux and other systems, apply the relevant vendor fixes or mitigations, and investigate exposed systems for evidence of compromise – particularly where exploitation has already been observed.
Key Takeaways
- CISA added six vulnerabilities to its KEV catalog based on evidence of exploitation.
- Citrix NetScaler’s CVE–2026–8452 is among the most urgent because active exploitation has been observed.
- The additions include vulnerabilities affecting Microsoft SQL Server and the Linux kernel.
- Four older vulnerabilities have been linked to activity attributed by Cisco Talos to UAT–10147.
- FCEB agencies face remediation deadlines of August 29 and September 9, 2026, depending on the vulnerability.
- The episode reinforces the risk posed by older vulnerabilities that remain present on exposed systems.
Sources
- CISA – Six vulnerabilities added to the Known Exploited Vulnerabilities catalog: https://www.cisa.gov/news–events/alerts/2026/08/26/cisa–adds–six–known–exploited–vulnerabilities–catalog
