As reported by CISA on August 26, 2026, the agency has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. The batch is notable not just for its content but for what it reveals about the enduring attack surface of enterprise IT — five of the six CVEs are over four years old.
Vulnerability Details
| CVE ID | Product | Type | Age | Exploited |
|---|---|---|---|---|
| CVE-2026-8452 | Citrix NetScaler ADC / Gateway | Memory Buffer Improper Restriction | Current (2026) | Yes |
| CVE-2022-0995 | Linux Kernel | Out-of-Bounds Write | ~4 years | Yes |
| CVE-2021-23758 | Ajax.NET Professional | Deserialization of Untrusted Data | ~5 years | Yes |
| CVE-2019-1068 | Microsoft SQL Server | Remote Code Execution | ~7 years | Yes |
| CVE-2015-5287 | Red Hat ABRT | Privilege Escalation | ~11 years | Yes |
| CVE-2015-3246 | Red Hat Libuser | Race Condition | ~11 years | Yes |
Why This Matters
The standout entry is CVE-2026-8452, a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Citrix (now Cloud Software Group) products have been persistent targets for threat actors — recall the 2023 NetScaler (CitrixBleed) campaign that fueled widespread ransomware operations. A fresh memory corruption flaw in the same product family, now confirmed as exploited in the wild, should trigger immediate concern for any organization with internet-facing NetScaler infrastructure.
The presence of 11-year-old Red Hat vulnerabilities (CVE-2015-3246 and CVE-2015-5287) in a 2026 KEV update underscores a persistent truth: threat actors do not retire old exploits — they recycle them against organizations that never patched.
The inclusion of CVE-2019-1068, a Microsoft SQL Server RCE, and CVE-2021-23758, a .NET deserialization flaw, signals continued targeting of mid-tier enterprise application stacks — the kind that often sit in semi-managed environments with inconsistent patch cadences.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Citrix NetScaler (CVE-2026-8452): Check for available hotfixes from Cloud Software Group. If no patch is available yet, restrict external access to NetScaler management interfaces, enforce strong authentication, and monitor logs for anomalous session behavior. Inspect for signs of prior compromise — memory corruption flaws may have been exploited before disclosure.
- Linux Kernel (CVE-2022-0995): Identify all hosts running kernel versions vulnerable to this out-of-bounds write. Prioritize container hosts and shared infrastructure. Patch or isolate.
- Microsoft SQL Server (CVE-2019-1068): Audit all SQL Server instances for missing cumulative updates. Restrict external access to port 1433 and enforce least-privilege service accounts.
- Ajax.NET Professional (CVE-2021-23758): This library is end-of-life. Remove or replace any application still using it. If removal is not immediately possible, implement WAF rules to block deserialization attempts and restrict access to affected endpoints.
- Red Hat (CVE-2015-3246, CVE-2015-5287): These should have been patched years ago. Their presence indicates a deeper asset management problem. Conduct a full inventory of legacy Linux systems and establish a decommissioning roadmap.
Strategic Actions
- Subscribe to the CISA KEV Catalog feed and integrate it into your vulnerability management pipeline for automated prioritization.
- Review BOD 26-04 guidance even if your organization is not an FCEB agency — the risk-based prioritization framework is sound for any enterprise.
- For every KEV addition, perform a compromise assessment on affected systems, not just a patch cycle. Exploitation may predate the patch.
The message from CISA is consistent and worth repeating: known exploited vulnerabilities are not theoretical risks. They are active attack paths. The age distribution in this batch — from 2015 to 2026 — is a reminder that defenders must own their full asset inventory, not just the assets they provisioned last quarter.
