CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
- ID
- 18514
- Status
- summarized
- Published
- 27 Aug 2026, 3:05 PM
- Fetched
- 27 Aug 2026, 4:29 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.0
- Created
- 27 Aug 2026, 4:29 PM
- Tags
- Audience
- developersdatabase_learners
What happened
CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation. The most notable is CVE-2026-8452, a memory buffer flaw in Citrix NetScaler ADC and Gateway being actively exploited with web shells ('x.php', 'z.php') dropped after initial access, with 36 exploitation attempts from 12 IPs across 10 countries including Singapore, Hong Kong, Japan, and Vietnam. The batch also includes a Microsoft SQL Server RCE (CVE-2019-1068), a Linux kernel privilege escalation (CVE-2022-0995), two Red Hat flaws, and an Ajax.NET Professional deserialization RCE.
Why it matters
If your org runs Citrix NetScaler ADC or Gateway, patch CVE-2026-8452 immediately and check for web shells named x.php or z.php — attack telemetry shows IPs from Southeast Asia actively probing. Developers on SQL Server should verify CVE-2019-1068 is patched given it allows RCE via the SQL service account. Most of this audience won't run NetScaler, so the practical impact is narrow.
Discussion angle
The NetScaler flaw is actively exploited with attacker IPs from Singapore, Hong Kong, and Vietnam — discuss whether Malaysian enterprise infrastructure teams treat CISA KEV as a patching SLA trigger, and how startup founders running on cloud-native stacks can safely ignore most of these unless they self-host on affected platforms.