CISA Adds Six Exploited Vulnerabilities to KEV, Including NetScaler Flaw
Summary
CISA added six vulnerabilities to its KEV catalog, including actively exploited CVE-2026-8452 affecting NetScaler. It set federal patch deadlines and highlighted persistent software weaknesses and AI-assisted exploitation.
Key points
- CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog and set federal remediation deadlines: August 29 for CVE-2019-1068 and CVE-2026-8452, and September 9 for the others.
- CVE-2026-8452 affects Citrix NetScaler ADC and Gateway; reports cited active exploitation involving web shells and discovery commands.
- Telemetry cited in the article recorded 36 exploitation attempts over 12 days from 12 attacker IP addresses.
- Cisco Talos linked four of the added vulnerabilities to UAT-10147 activity targeting web servers in several sectors worldwide.
- The article says there is no public information on how CVE-2019-1068 is being exploited in the wild.
- CISA’s review reported 7,701 injection-related CVEs in 2024 and 21,019 in 2025, and said memory-safety and improper-input-validation weaknesses are disproportionately represented in KEVs.
Article Details
- Event Type
- CISA added six exploited vulnerabilities to its Known Exploited Vulnerabilities catalog.
- Impact
- CVE-2026-8452 affecting Citrix NetScaler ADC and NetScaler Gateway is actively exploited. Attackers were reported dropping web shells and running discovery commands. The listed vulnerabilities affect Microsoft SQL Server, Linux Kernel, Red Hat software, and Ajax.NET Professional; the article reports no public information on in-the-wild exploitation of CVE-2019-1068.
MITRE ATT&CK
CVE
CVE-2015-3246CVE-2015-3246 – A race condition vulnerability in Red Hat libuser that could allow an authenticated local user to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.CVE-2015-5287CVE-2015-5287 – A privilege escalation vulnerability in Red Hat Automatic Bug Reporting Tool (ABRT) that could allow local users with certain permissions to gain privileges via a symlink attack on a file with aCVE-2019-1068CVE-2019-1068 – A remote code execution vulnerability in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.CVE-2021-23758CVE-2021-23758 – A deserialization of untrusted data vulnerability in Ajax.NET Professional (AjaxPro) that could allow for remote code execution via arbitrary .NET classes.CVE-2022-0995CVE-2022-0995 – An out-of-bounds memory write vulnerability in Linux Kernel that could allow a local user to gain privileged access or cause a denial of service on the system.CVE-2026-8452CVE-2026-8452 in Citrix NetScaler ADC and NetScaler Gateway is actively exploited.
Threat Actors
Vendors
Citrixvulnerabilities to its Known Exploited Vulnerabilities catalog, including an actively exploited flaw in Citrix NetScaler ADC and NetScaler Gateway, while also setting remediation deadlines for federal agencies.MicrosoftCVE-2019-1068 – A remote code execution vulnerability in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.Red HatCVE-2015-5287 – A privilege escalation vulnerability in Red Hat Automatic Bug Reporting Tool (ABRT) that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a
Products
AjaxProCVE-2021-23758 – A deserialization of untrusted data vulnerability in Ajax.NET Professional (AjaxPro) that could allow for remote code execution via arbitrary .NET classes.Linux kernelCVE-2022-0995 – An out-of-bounds memory write vulnerability in Linux Kernel that could allow a local user to gain privileged access or cause a denial of service on the system.Microsoft SQL ServerCVE-2019-1068 – A remote code execution vulnerability in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.NetScaler ADCto its Known Exploited Vulnerabilities catalog, including an actively exploited flaw in Citrix NetScaler ADC and NetScaler Gateway, while also setting remediation deadlines for federal agencies.NetScaler GatewayExploited Vulnerabilities catalog, including an actively exploited flaw in Citrix NetScaler ADC and NetScaler Gateway, while also setting remediation deadlines for federal agencies.Red Hat Automatic Bug Reporting Tool (ABRT)CVE-2015-5287 – A privilege escalation vulnerability in Red Hat Automatic Bug Reporting Tool (ABRT) that could allow local users with certain permissions to gain privileges via a symlink attack on a file with aRed Hat libuserCVE-2015-3246 – A race condition vulnerability in Red Hat libuser that could allow an authenticated local user to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.
Countries
Germanyattempts have been detected over the past 12 days from 12 unique attacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.Hong Kongbeen detected over the past 12 days from 12 unique attacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.Japandetected over the past 12 days from 12 unique attacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.Russiadays from 12 unique attacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.Singapore12 unique attacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.Switzerlandattempts have been detected over the past 12 days from 12 unique attacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.Türkiyeattacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.the Netherlandsthe past 12 days from 12 unique attacker IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.the U.S.IP addresses from Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.Vietnamfrom Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.
Industries
Educationcybercrime group known as UAT-10147 that’s targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.Gamingthat’s targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.Mediagroup known as UAT-10147 that’s targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.Technologyknown as UAT-10147 that’s targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.