CISA Adds Six Actively Exploited Vulnerabilities to KEV List

Posted on

The United States Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog by adding six flaws that are confirmed to be under active attack, including serious issues in Citrix NetScaler, Microsoft SQL Server, the Linux kernel, and Red Hat platforms. These vulnerabilities pose varied risks—from remote code execution to privilege escalation and system stability concerns.

Vulnerabilities and Active Exploitation

Here are the six newly added flaws:

  • CVE-2019-1068: A remote code execution bug in Microsoft SQL Server enables attackers to run code under the SQL Server Database Engine service account.
  • CVE-2026-8452: A buffer boundary error in Citrix NetScaler ADC and Gateway that can trigger denial-of-service; this flaw is under active exploitation. Attackers have been using web shells (“x.php” and “z.php”) and running commands like idand echoagainst targets.
  • CVE-2022-0995: An out-of-bounds memory write in the Linux kernel that may allow a local user to escalate privileges or crash the system.
  • CVE-2015-5287: A privilege escalation issue in Red Hat’s Automatic Bug Reporting Tool (ABRT), exploitable via symlink attacks on files with predictable names.
  • CVE-2015-3246: A race condition flaw in Red Hat’s libuser that could lead to privilege escalation or disruption by corrupting the /etc/passwdfile.
  • CVE-2021-23758: A deserialization of untrusted data vulnerability in Ajax.NET Professional (AjaxPro), allowing attackers to achieve remote code execution via arbitrary.NET classes.

Telemetry shows that for CVE-2026-8452 alone there have been at least 36 attempts to exploit this bug in the past 12 days, coming from 12 distinct IP addresses across Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.

Remediation Deadlines and Broader Implications

CISA is urging Federal Civilian Executive Branch (FCEB) agencies to apply patches for both CVE-2019-1068 and CVE-2026-8452 by August 29, 2026. The remaining four vulnerabilities must be addressed by September 9, 2026.

In conjunction with these additions, CISA released a review identifying the root causes of insecure software. Its analysis of CVE records from 2024 and 2025 highlights injection weaknesses as the most prevalent category—totaling 7,701 CVEs in 2024 and 21,019 in 2025. Additionally, memory safety and improper input validation were especially common among KEVs compared to the overall CVE pool, reflecting trends in real-world exploitation.

This expansion of the KEV catalog puts into focus how longtime known flaws still pose substantial risk, especially when adversaries automate attack tools.

What this means:Organizations relying on vulnerable versions of NetScaler, SQL Server, Red Hat ABRT/libuser, Linux, or Ajax.NET should prioritize remediation before exploitation escalates. With zero-day style tactics now more accessible through botnets and AI tools, even old CVEs can rapidly become active threats.

Related Posts