CISA Updates KEV Catalog as Threat Actors Target Citrix NetScaler and Legacy Enterprise Software
On August 26, 2026, CISA expanded its Known Exploited Vulnerabilities catalog with six additions across enterprise technologies. A prominent entry is CVE-2026-8452, a memory overflow issue affecting NetScaler ADC and Gateway appliances configured for AAA virtual servers or VPN gateways. While Citrix initially described the vulnerability as causing unpredictable behavior or denial-of-service, security researchers at WatchTowr published a proof-of-concept demonstrating unauthenticated remote code execution. Threat telemetry firms Previdian and Defused subsequently reported in-the-wild exploitation involving web shell deployments and discovery commands like `id` and `echo`. Fixed firmware releases include versions `14.1-72.61`, `13.1-63.18`, and `13.1-37.272`. Alongside the NetScaler flaw, CISA flagged CVE-2019-1068, a remote code execution bug in Microsoft SQL Server triggered via crafted queries. This flaw enables attackers to execute arbitrary code within the database engine's service account context. The catalog additions also encompass legacy vulnerabilities including Red Hat `libuser` race conditions (CVE-2015-3246), Red Hat ABRT privilege escalation (CVE-2015-5287), Ajax.NET Professional deserialization (CVE-2021-23758), and a Linux kernel out-of-bounds write flaw (CVE-2022-0995). CISA established an August 29 remediation deadline for the Citrix and Microsoft SQL vulnerabilities for affected federal entities, with remaining flaws slated for mitigation by September 9. Historical context notes this follows rapid exploitation of another NetScaler flaw, CVE-2026-8451, earlier in the year.
Commentary
Edge devices and database tiers remain prime real estate for initial access brokers and lateral movement. CVE-2026-8452 is especially urgent because public proof-of-concept code bridged the gap between a vendor-reported denial-of-service condition and full unauthenticated remote code execution. Appliances functioning as AAA virtual servers or SSL VPN gateways are directly internet-facing, meaning web shells can be dropped without prior credential access. Meanwhile, the addition of a seven-year-old Microsoft SQL Server flaw (CVE-2019-1068) alongside aged Linux/Red Hat bugs highlights that attackers frequently scan for unpatched legacy infrastructure where database service accounts retain excessive local privileges. Mitigation must go beyond simply applying firmware updates or database patches: organizations should perform forensic sweeps on exposed NetScaler instances for unauthorized shell scripts or webshell artifacts, audit SQL Server hosts for anomalous child processes spawned by database services, and enforce strict network segmentation around internal data stores.
The Quote to Remember
“The vendor said the vulnerability can only be exploited against appliances configured as an AAA virtual server or a Gateway VPN server. Versions 14.1-72.61 (FIPS), 13.1-63.18 and 13.1-37.272 fix the security hole.”
“Exploiting this vulnerability involves submitting a specially crafted query to an affected SQL server. It can allow an attacker to execute code in the context of the SQL Server Database Engine service account.”