On August 26, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation.
The list is notable because it spans Citrix NetScaler, Microsoft SQL Server, Ajax.NET Professional, Linux kernel components, and older Red Hat software.
The key message for security teams is simple:
A vulnerability entering KEV changes its operational priority. It is no longer just another item in the vulnerability backlog—it is a vulnerability with evidence of exploitation.
CISA’s addition of these six vulnerabilities is based on active exploitation, reinforcing why KEV should be treated as an operational risk signal rather than simply another vulnerability database.
1. CVE-2026-8452 — Citrix NetScaler
The most recent vulnerability in the group affects Citrix NetScaler ADC and NetScaler Gateway.
CISA describes it as an improper restriction of operations within the bounds of a memory buffer vulnerability.
This deserves particular attention because NetScaler commonly sits at the external access boundary of an organization.
Security teams should therefore identify:
- Internet-facing NetScaler ADC/Gateway appliances
- Affected software versions
- Gateway and authentication services exposed through the appliance
- Whether the vendor-recommended fixed versions have been deployed
- Indicators of compromise associated with exploitation
For an internet-facing infrastructure component, remediation should not wait for the normal monthly vulnerability-management cycle.
2. CVE-2019-1068 — Microsoft SQL Server
The second major concern is CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server.
The interesting aspect is its age.
This is a 2019 vulnerability being added to KEV in 2026.
That is an important reminder that vulnerability age is not a reliable indicator of current threat.
An organization may have a vulnerability that has existed for years, passed through multiple vulnerability-management cycles, and still become an immediate priority when exploitation is observed.
The right question is therefore not:
“How old is the CVE?”
It is:
“Is the vulnerable technology present, exposed, and being exploited?”
3. CVE-2021-23758 — Ajax.NET Professional
CVE-2021-23758 affects Ajax.NET Professional and involves deserialization of untrusted data.
Deserialization vulnerabilities can be particularly dangerous when attacker-controlled serialized data reaches application components that process it without adequate validation.
Security teams should determine whether Ajax.NET Professional exists within:
- Legacy ASP.NET applications
- Internally hosted business applications
- Internet-facing web applications
- Application servers that may have been overlooked during software inventory
This is a good example of why software-component inventory matters. Vulnerabilities in older application frameworks can remain invisible when organizations inventory only operating systems and major commercial products.
4. CVE-2015-3246 — Red Hat Libuser
CVE-2015-3246 is a race-condition vulnerability affecting Red Hat Libuser. CISA has now classified it as a known exploited vulnerability.
Although this is an older vulnerability, its inclusion demonstrates that attackers continue to use legacy local privilege-escalation vulnerabilities during post-compromise activity.
The practical concern is not necessarily initial access.
It can be what happens after an attacker gets onto the Linux system.
A successful privilege escalation can turn a limited foothold into elevated control.
5. CVE-2015-5287 — Red Hat ABRT
CVE-2015-5287 affects the Red Hat Automatic Bug Reporting Tool (ABRT) and is classified by CISA as a privilege-escalation vulnerability.
Again, the age of the vulnerability is striking.
It reinforces a recurring attack pattern:
Initial compromise → local foothold → privilege escalation → persistence → lateral movement
Therefore, Linux privilege-escalation vulnerabilities should not automatically be treated as low priority simply because they require local access.
6. CVE-2022-0995 — Linux Kernel
The final addition is CVE-2022-0995, an out-of-bounds write vulnerability in the Linux kernel.
Kernel-level vulnerabilities are particularly important because successful exploitation can potentially move an attacker from a restricted user context to much higher levels of system control.
This becomes even more relevant when the vulnerable host is an internet-facing server that has already been compromised through another weakness.
The Bigger Story Behind the Six CVEs
The six vulnerabilities do not represent a single technology stack or a single attack technique.
Instead, they demonstrate the different stages of a real-world intrusion.
An attacker may exploit an internet-facing application or appliance to gain an initial foothold.
From there, older local privilege-escalation vulnerabilities can be used to increase privileges.
This means vulnerability management cannot operate as a simple:
Critical CVSS → Patch first
model.
A better prioritization model is:
Known exploitation + exposure + asset criticality + attacker access + business impact
That is precisely where the CISA KEV Catalog becomes valuable.
What Security Teams Should Do
For these six CVEs, organizations should move beyond simply checking whether the CVE exists in their vulnerability scanner.
1. Identify exposure
Determine whether the affected products actually exist in your environment.
2. Identify internet-facing assets
Prioritize systems exposed directly or indirectly to the internet, particularly:
- NetScaler ADC/Gateway
- SQL Server
- Web applications using vulnerable frameworks
3. Validate patch status
Do not rely only on vulnerability-scanner timestamps.
Validate the actual installed version/build against the vendor’s remediation guidance.
4. Hunt for exploitation
Because CISA’s KEV inclusion is based on evidence of exploitation, review:
- Authentication logs
- Web/application logs
- NetScaler logs
- SQL Server activity
- Linux authentication and privilege-escalation events
- EDR telemetry
- Network connections from affected systems
5. Check for compromise before closing the ticket
A patched system is not necessarily a clean system.
If an internet-facing asset was vulnerable and exposed during a period of active exploitation, security teams should consider incident-response validation before marking the vulnerability simply as remediated.
Final Takeaway
The most important lesson from the August 26 CISA KEV additions is not that six more CVEs need to be patched.
It is that attackers continue to combine new vulnerabilities with old vulnerabilities.
A 2015 privilege-escalation vulnerability, a 2019 SQL Server flaw, a 2021 application vulnerability, a 2022 Linux kernel flaw, and a 2026 NetScaler vulnerability can all become relevant to defenders at the same time.
That is why an effective vulnerability-management program should continuously correlate:
Asset inventory + exposure + vulnerability + exploitation intelligence + business criticality.
The KEV catalog provides the exploitation signal.
The responsibility for turning that signal into risk-based action remains with the organization.
