The six additions are especially noteworthy because this is not a collection of newly disclosed theoretical weaknesses. CISA added them to the Known Exploited Vulnerabilities Catalog specifically because there is evidence of exploitation in the wild. The August 26, 2026 additions span Red Hat components, Microsoft SQL Server, Ajax.NET Professional, the Linux kernel and Citrix NetScaler, and they range from privilege-escalation flaws to remote code execution and memory corruption. That diversity is useful in itself because it demonstrates something vulnerability-management programs sometimes manage to forget: attackers do not care whether a vulnerability is new, glamorous or currently generating headlines. They care whether it works. Several of these CVEs are years old, yet they have only now been elevated into CISA's KEV Catalog because real attackers are still finding vulnerable systems to exploit.

The six vulnerabilities are CVE-2015-3246 in Red Hat libuser, CVE-2015-5287 in Red Hat Automatic Bug Reporting Tool, CVE-2019-1068 in Microsoft SQL Server, CVE-2021-23758 in Ajax.NET Professional, CVE-2022-0995 in the Linux kernel and CVE-2026-8452 in Citrix NetScaler ADC and NetScaler Gateway. Of these, CISA has assigned particularly short remediation windows to CVE-2019-1068 and CVE-2026-8452, with affected U.S. federal systems expected to address them by August 29, 2026, while the remaining four have a September 9 deadline. The deadlines matter because KEV inclusion changes the vulnerability from "something security teams should eventually examine" into a confirmed active threat that should be moved close to the front of the remediation queue.

CVE-2026-8452 deserves immediate attention because it affects Citrix NetScaler ADC and NetScaler Gateway, systems that frequently sit directly on an organization's perimeter and provide remote-access, authentication or application-delivery functionality. The vulnerability involves improper restriction of operations within the bounds of a memory buffer, effectively a memory-corruption condition. Security research around the issue indicates that specially crafted SAML-related input can trigger a heap overflow on vulnerable configurations. Because NetScaler Gateway and AAA virtual servers are often exposed directly to the internet, exploitation opportunities can exist before an attacker has gained any internal foothold. CISA's decision to add the flaw to KEV confirms that this has moved beyond hypothetical exploitability into actual attacker activity.  

The location of NetScaler within enterprise architecture makes exploitation particularly dangerous. A compromised perimeter appliance can provide an attacker with more than code execution on an isolated server. These devices may contain authentication configuration, certificates, private keys, LDAP service-account credentials, RADIUS secrets, API credentials and information describing internal application infrastructure. They also frequently communicate directly with identity systems and sensitive backend services. Consequently, organizations should not think of CVE-2026-8452 as merely another appliance vulnerability that disappears once firmware is upgraded. If exploitation is suspected, administrators should consider whether credentials or cryptographic material stored on the appliance may already have been accessed and whether those secrets require rotation. 

This distinction between patching and incident response is becoming increasingly important. Installing an updated NetScaler build eliminates the known vulnerable code path, but it does not automatically remove persistence established before the upgrade or invalidate credentials an attacker may already possess. Organizations operating affected internet-facing appliances should preserve logs and configuration information before remediation where practical, examine authentication activity, review unusual configuration changes and investigate connections between the appliance and internal systems. A clean vulnerability scan after patching is comforting, certainly, but scanners unfortunately do not travel backward in time and evict yesterday's intruder.

CVE-2019-1068 presents a different but equally significant risk. It is a Microsoft SQL Server remote-code-execution vulnerability originally addressed in 2019. An authenticated attacker can send specially crafted queries to a vulnerable SQL Server and execute code in the context of the SQL Server Database Engine service account. CISA's addition of a seven-year-old vulnerability to KEV in 2026 is perhaps the most useful part of the announcement because it demonstrates the extraordinary longevity of exploitable enterprise software. Security teams sometimes downgrade old CVEs on the assumption that anything disclosed several years ago must already have disappeared from production. Enterprise environments have an impressive ability to preserve obsolete software long after everyone assumed somebody else had upgraded it. 

The authentication requirement for CVE-2019-1068 should not lead organizations to underestimate it. Many real intrusions begin with compromised user or application credentials. Once attackers obtain database access, an authenticated RCE vulnerability can transform limited database privileges into operating-system-level execution under the SQL Server service identity. If that service account possesses excessive local or domain privileges, the consequences can extend substantially beyond the database itself. Database servers frequently contain business-critical information and maintain trusted connections to application servers, backup infrastructure and administrative systems, making them valuable pivot points during lateral movement.

This is also a strong reminder why service accounts should follow strict least-privilege principles. SQL Server does not normally require broad domain privileges simply because configuring a highly privileged service account was convenient during installation twelve years ago and nobody has wanted to touch it since. Database service identities should have only the rights necessary for their specific functions, should not possess interactive logon privileges unless required and should not be reused across unrelated systems. Restricting service-account privileges reduces the blast radius if vulnerabilities such as CVE-2019-1068 provide attackers with execution inside the database process.

CVE-2021-23758 affects Ajax.NET Professional and involves deserialization of untrusted data. Unsafe deserialization remains one of the more persistent classes of application-security problems because it violates a fundamental trust-boundary principle: data controlled by an external party should not automatically be reconstructed into application objects capable of influencing execution. Depending on implementation and available object chains, insecure deserialization can potentially lead to arbitrary code execution. CISA's confirmation of active exploitation means organizations should inventory applications that still incorporate Ajax.NET Professional rather than assuming the component disappeared simply because nobody remembers approving its deployment.

Older application frameworks create a particular challenge because they are often embedded inside business applications rather than installed as obvious standalone products. A vulnerability scanner might identify the operating system and web server correctly while completely missing an outdated library packaged inside an internally developed application. Software composition analysis and accurate dependency inventories therefore become essential. Organizations should know which third-party libraries their applications depend upon and where those components are deployed. Otherwise, every urgent CVE announcement becomes an archaeological project in which administrators search source trees hoping to discover whether somebody used the affected library a decade ago.

CVE-2022-0995 affects the Linux kernel's watch_queue subsystem and can result in an out-of-bounds write. The vulnerability is primarily significant as a local privilege-escalation opportunity rather than an internet-facing initial-access mechanism. This distinction illustrates why vulnerability prioritization cannot be based purely on whether exploitation originates remotely. An attacker who compromises a low-privileged web application, container or user account may subsequently exploit a kernel vulnerability to obtain greater control over the host. Initial access and privilege escalation frequently depend on completely different vulnerabilities, yet together they form a much more dangerous attack chain. 

Linux privilege-escalation vulnerabilities are especially relevant in environments hosting web services, development infrastructure and containerized applications. Security teams may correctly restrict externally exposed applications to low-privilege service accounts, assuming that compromise of the application will therefore remain contained. A local kernel vulnerability can undermine that containment boundary. Once attackers gain higher privileges, they may access additional credentials, interfere with security controls, modify binaries, establish persistence or interact with workloads that were previously inaccessible.

The Linux finding also demonstrates why kernel patching needs to be treated as a cybersecurity requirement rather than merely system maintenance. Organizations frequently postpone kernel upgrades because they require testing and system reboots, particularly on production servers. That operational caution is understandable, but prolonged patch delays accumulate risk. Where immediate rebooting is genuinely difficult, organizations should consider compensating controls, live-patching capabilities where supported, tighter workload isolation and reduced exposure until full remediation can be completed.

CVE-2015-3246 in Red Hat libuser is another older vulnerability now receiving renewed attention because of confirmed exploitation. The flaw involves a race condition that can be abused for privilege escalation. Race-condition vulnerabilities are interesting because exploitation depends on manipulating the timing or sequence of operations so that security assumptions made by the software no longer hold. These bugs may appear unreliable during ordinary testing, but attackers can automate repeated attempts until the required condition occurs. The age of this vulnerability is again significant: software from 2015 can remain operational in enterprise infrastructure eleven years later, particularly in appliances, legacy applications and systems that organizations consider too important to upgrade. 

CVE-2015-5287 affects Red Hat's Automatic Bug Reporting Tool, or ABRT, and provides another path for privilege escalation. Security teams naturally prioritize vulnerabilities in internet-facing servers, but local privilege-escalation flaws become extremely valuable after attackers establish initial access using phishing, stolen credentials, vulnerable applications or exposed services. Once a low-privileged attacker reaches a Linux host, any exploitable local vulnerability can potentially convert that foothold into administrative control. CISA's decision to include both of these older Red Hat vulnerabilities therefore suggests defenders should review not just perimeter exposure but also post-compromise attack paths. 

Taken together, CVE-2015-3246, CVE-2015-5287 and CVE-2022-0995 illustrate why attack-path analysis is more useful than simply ranking vulnerabilities by CVSS score. A local privilege-escalation vulnerability may appear less urgent than an unauthenticated remote-code-execution flaw when examined individually. But if an internet-facing application already provides attackers with a restricted shell, the local privilege-escalation vulnerability may be exactly what converts that limited compromise into full host control. Risk therefore depends on both the vulnerability itself and its position inside the architecture.

CISA's KEV Catalog exists precisely because traditional severity-based vulnerability management has limitations. Thousands of vulnerabilities receive high or critical severity ratings every year, while security teams have limited resources to investigate and patch them. KEV adds another extremely valuable dimension: evidence that attackers are actually using the vulnerability. That operational evidence should heavily influence prioritization. CISA established the catalog to help organizations concentrate remediation effort on vulnerabilities known to present active risk rather than attempting to treat every theoretical vulnerability as equally urgent. 

A sensible vulnerability-management program should therefore combine multiple factors instead of relying exclusively on CVSS. KEV status, internet exposure, exploit availability, asset criticality, attacker privileges required, vulnerability age, compensating controls and the business function of the affected system all contribute to actual risk. An actively exploited CVSS 8 vulnerability on an internet-facing authentication gateway may deserve significantly faster remediation than a CVSS 9.8 vulnerability buried inside an isolated laboratory network. Severity tells us what could happen under defined conditions; exposure and exploitation intelligence tell us how likely those conditions are to matter in the real world.

The August 26 additions also highlight the security consequences of long-tail vulnerability management. Five of the six flaws were disclosed before 2026, with some dating back to 2015. This should concern organizations maintaining legacy infrastructure. Attackers increasingly benefit from the enormous backlog of systems that organizations never fully patch. They do not necessarily need new zero-days when an eleven-year-old privilege-escalation flaw still works perfectly well against forgotten servers. From an attacker economics perspective, old vulnerabilities are attractive because exploit techniques are documented, defensive understanding varies and development costs are minimal.

Organizations should therefore treat KEV additions involving old vulnerabilities as prompts for asset-discovery exercises. If security teams believe that a 2015 Red Hat vulnerability cannot affect them, they should be able to demonstrate that conclusion through inventory data rather than institutional memory. Unsupported operating systems, forgotten virtual machines, laboratory servers, backup appliances, vendor-managed systems and internal applications frequently contain older components that disappear from ordinary patch-management dashboards while remaining perfectly visible to attackers who discover them.

The mixture of vulnerabilities in this update also demonstrates how real attacks cross technological boundaries. A threat actor might initially compromise an internet-facing NetScaler appliance, obtain credentials, authenticate to an internal database, exploit SQL Server, gain access to a Linux application server and then use a local kernel or Red Hat privilege-escalation flaw to obtain root access. The six KEV entries are not evidence that such a specific attack chain is occurring, but they illustrate why defenders should think in terms of pathways rather than isolated CVEs. Attackers combine whichever weaknesses exist in the environment. Organizational charts and product categories are largely irrelevant to them.

Network segmentation can substantially reduce the value of these vulnerabilities to attackers. An exposed remote-access gateway should not automatically provide unrestricted connectivity to database servers. SQL Servers should accept connections only from approved application and administrative systems. Linux application servers should not freely access identity infrastructure or management networks. Proper segmentation does not remove vulnerabilities, but it forces attackers to cross additional policy boundaries after each compromise and creates more opportunities for detection.

Outbound restrictions deserve similar attention. Once remote code execution occurs, attackers frequently attempt to download secondary payloads, establish reverse shells or connect to command-and-control infrastructure. Servers generally have predictable communication requirements, yet many enterprise environments still allow unrestricted outbound internet access from production systems. Restricting server egress to required destinations can convert successful code execution into a much less useful compromise and generate highly valuable alerts when unexpected connections are attempted.

Detection teams should also use the KEV announcement as a hunting trigger rather than waiting for patch-management teams to finish remediation. Systems running affected products should be reviewed for suspicious historical activity, particularly where they were internet-facing or had high-value internal access. Relevant indicators may include unexplained process creation from SQL Server or NetScaler contexts, abnormal privilege escalation on Linux hosts, unexpected modifications to application files, suspicious authentication events and unusual outbound network connections.

This is especially important because patching does not answer the question of whether exploitation already occurred. If an organization upgrades a vulnerable appliance today but an attacker compromised it yesterday, remediation is incomplete until persistence, credentials and affected downstream systems have been investigated. Modern vulnerability management therefore needs a direct link to incident response. Certain findings, particularly KEV vulnerabilities on externally reachable assets, should automatically trigger compromise assessment rather than simply generating another patch ticket.

The CISA update also reinforces an important principle for security product vendors and appliance manufacturers: underlying operating-system and third-party components remain part of the security responsibility. An appliance may present a proprietary management interface while internally relying on Linux kernels, libraries, web frameworks or database engines with their own vulnerability histories. Vendors need accurate software bills of materials and processes capable of determining rapidly whether newly exploited vulnerabilities affect embedded components. Customers should not have to guess whether a CVE applies merely because the underlying package is hidden behind an appliance interface.

For security teams, the practical priority should be clear. Identify any customer-managed Citrix NetScaler ADC or Gateway systems affected by CVE-2026-8452 and remediate them immediately because these systems are commonly perimeter-facing and CISA's remediation deadline is August 29. Identify affected SQL Server installations vulnerable to CVE-2019-1068, especially those reachable from untrusted or partner networks, and confirm that the relevant security updates have been deployed. Then inventory Ajax.NET Professional applications and affected Red Hat and Linux systems for the remaining four vulnerabilities, prioritizing servers where successful privilege escalation would expose sensitive workloads or administrative infrastructure. 

Most importantly, organizations should not treat KEV as another vulnerability feed to dump into an already overloaded scanner dashboard. Its value lies precisely in helping reduce that noise. A CVE entering KEV means defenders now know something extremely important that a raw severity score cannot tell them: somebody is actually exploiting it. That information should change remediation priority, hunting activity and executive risk reporting.

The broader lesson from these six vulnerabilities is that cybersecurity has a very long memory. CVE-2015-3246 and CVE-2015-5287 demonstrate that a vulnerability can remain relevant more than a decade after disclosure. CVE-2019-1068 shows that enterprise database infrastructure can carry exploitable weaknesses for years. CVE-2022-0995 highlights the importance of post-compromise privilege escalation, while CVE-2026-8452 demonstrates the continuing attractiveness of internet-facing security appliances. Attackers are not conducting vulnerability management according to release dates. They maintain a catalogue of techniques that work and use whichever one matches the system they encounter.

That is ultimately why CISA's Known Exploited Vulnerabilities Catalog is so useful. Vulnerability management should not become a competition to patch the largest number of CVEs. It should be an exercise in removing the vulnerabilities most likely to provide attackers with meaningful attack paths. When a vulnerability is confirmed to be exploited, affects a reachable asset and can produce code execution or privilege escalation, the debate about whether it should be prioritized becomes considerably shorter. The uncomfortable part is discovering that some of the most urgent vulnerabilities in 2026 were already waiting for a patch when many of today's servers were still being ordered. 

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the

Source: CISA Adds Six Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 26 Aug 2026.