CISA Adds Six Exploited Vulnerabilities to Its KEV Catalog, Including a Citrix NetScaler Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six entries at once to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday. The move was prompted by evidence that they are being actively exploited by threat actors.

What was added

The list includes vulnerabilities of various vintages and different natures:

• CVE-2026-8452 — a memory buffer boundary error in Citrix NetScaler ADC and NetScaler Gateway that leads to denial of service.
• CVE-2019-1068 — remote code execution in Microsoft SQL Server in the context of the database engine service account.
• CVE-2022-0995 — an out-of-bounds write in the Linux kernel that lets a local user escalate privileges.
• CVE-2015-5287 and CVE-2015-3246 — privilege escalation in Red Hat ABRT (via a symbolic-link attack) and a race condition in libuser that allows /etc/passwd to be corrupted.
• CVE-2021-23758 — insecure deserialization in Ajax.NET Professional, opening the door to code execution.

Attacks in real time

The Defused Cyber and Previdian (formerly KEVIntel) services reported active attempts to exploit the NetScaler flaw. According to Previdian, attackers uploaded a web shell under the names x.php and z.php, then ran reconnaissance commands such as id and echo. Over twelve days, telemetry recorded 36 attempts from twelve unique IP addresses — in Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Turkey, the United States and Vietnam.

The four older vulnerabilities landed in the catalog following a Cisco Talos report on the Chinese cybercriminal group UAT-10147, which attacks Windows and Linux servers worldwide across the education, media, technology and gaming sectors. There is no public data yet on how CVE-2019-1068 is being exploited in the wild.

Federal civilian agencies have been directed to remediate the SQL Server and NetScaler flaws by August 29, 2026, and the rest by September 9.

The roots of the problem

At the same time, CISA released an overview of the root causes of insecure software. An analysis of CVE records for 2024 and 2025 showed that the dominant category was injection vulnerabilities: 7,701 records in 2024 and 21,019 in 2025. The agency stresses that attackers still make use of simple, long-known holes in externally accessible systems, while artificial intelligence is being applied to automate attacks. Memory-safety errors and improper input validation, CISA notes, appear in the KEV catalog disproportionately often compared with the overall mass of vulnerabilities — and it is precisely these root causes that developers should pay attention to.

Source: The Hacker News