Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2019-1068 - A remote code execution vulnerability in
Analysis Summary
Based on the provided article, here is the summary of the vulnerabilities recently added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
# Vulnerability: CISA KEV Update (August 2026) - Multiple Exploited Flaws
## CVE Details
* **CVE-2026-8452**
* **CVSS Score:** High (Specific score not listed)
* **CWE:** Improper Restriction of Operations within the Bounds of a Memory Buffer
* **CVE-2019-1068**
* **CVSS Score:** High (Specific score not listed)
* **CWE:** Remote Code Execution (RCE)
* **CVE-2022-0995**
* **CVSS Score:** Not listed (Local Escalation of Privilege)
* **CWE:** Out-of-bounds Memory Write
* **CVE-2015-5287**
* **CVSS Score:** Not listed
* **CWE:** Privilege Escalation (Symlink attack)
* **CVE-2015-3246**
* **CVSS Score:** Not listed
* **CWE:** Race Condition
* **CVE-2021-23758**
* **CVSS Score:** Not listed
* **CWE:** Deserialization of Untrusted Data
## Affected Systems
* **Products:**
* Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-8452)
* Microsoft SQL Server (CVE-2019-1068)
* Linux Kernel (CVE-2022-0995)
* Red Hat Automatic Bug Reporting Tool / ABRT (CVE-2015-5287)
* Red Hat libuser (CVE-2015-3246)
* Ajax.NET Professional / AjaxPro (CVE-2021-23758)
* **Versions:** Varies by vendor; Citrix and Microsoft have issued specific patches for the affected versions listed in their respective advisories.
* **Configurations:** CVE-2019-1068 targets the SQL Server Database Engine service account.
## Vulnerability Description
The primary focus of recent activity involves **CVE-2026-8452**, a memory buffer vulnerability in Citrix NetScaler products that allows for Denial of Service (DoS) and potentially further exploitation. **CVE-2019-1068** is a legacy RCE flaw in MS SQL Server that allows execution in the context of the database engine. Other listed flaws include Linux kernel memory corruption and legacy Red Hat privilege escalation bugs (race conditions and symlink attacks) being utilized by threat actors like UAT-10147.
## Exploitation
* **Status:** Exploited in the wild (All listed CVEs added to CISA KEV).
* **Complexity:**
* **Low to Medium:** Citrix (CVE-2026-8452) is seeing active, high-volume attempts.
* **High:** Race conditions (CVE-2015-3246) typically require specific timing.
* **Attack Vector:**
* **Network:** CVE-2026-8452, CVE-2019-1068, CVE-2021-23758.
* **Local:** CVE-2022-0995, CVE-2015-5287, CVE-2015-3246.
## Impact
* **Confidentiality:** High (RCE and Privilege Escalation flaws).
* **Integrity:** High (Ability to corrupt `/etc/passwd` or execute code).
* **Availability:** High (Denial of Service impacts on Citrix and Linux).
## Remediation
### Patches
* **Citrix:** Apply updates for NetScaler ADC and Gateway immediately.
* **Microsoft:** Update SQL Server to the latest supported Service Pack/Cumulative Update.
* **Linux/Red Hat:** Update `kernel`, `abrt`, and `libuser` packages via yum/dnf.
### Workarounds
* Ensure SQL Server is not exposed directly to the internet.
* Disable AjaxPro if not strictly necessary for web applications.
## Detection
* **Indicators of Compromise:** For Citrix (CVE-2026-8452), look for web shells named `x.php` and `z.php` and execution of discovery commands like `id` and `echo`.
* **Detection Methods:** Monitor for 12 unique attacker IPs identified by Previdian across global regions (Switzerland, Russia, U.S., etc.). Utilize CISA’s KEV catalog to audit internet-facing assets.
## References
* CISA KEV Catalog: hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog
* Citrix Advisory: hxxps://thehackernews[.]com/2026/07/citrix-patches-six-netscaler-flaws[.]html
* Previdian Technical Analysis: hxxps://previdian[.]com/CVE-2026-8452
* Microsoft SQL Security: hxxps://medium[.]com/@fecassie/discovering-an-undisclosed-stack-overflow-vulnerability-in-microsoft-sql-server-cve-2019-1068-933b9df1a8b