CISA Updates KEV Catalog as Threat Actors Target Citrix NetScaler and Legacy Enterprise Software
On August 26, 2026, CISA expanded its Known Exploited Vulnerabilities catalog with six additions across enterprise technologies. A prominent entry is CVE-2026-8452, a memory overflow issue affecting NetScaler ADC and Gateway appliances configured for AAA virtual servers or VPN gateways. While Citrix initially described the vulnerability as causing unpredictable behavior or denial-of-service, security researchers at WatchTowr published a proof-of-concept demonstrating unauthenticated remote code execution. Threat telemetry firms Previdian and Defused subsequently reported in-the-wild exploitation involving web shell deployments and discovery commands like `id` and `echo`. Fixed firmware releases include versions `14.1-72.61`, `13.1-63.18`, and `13.1-37.272`. Alongside the NetScaler flaw, CISA flagged CVE-2019-1068, a remote code execution bug in Microsoft SQL Server triggered via crafted queries. This flaw enables attackers to execute arbitrary code within the database engine's service account context. The catalog additions also encompass legacy vulnerabilities including Red Hat `libuser` race conditions (CVE-2015-3246), Red Hat ABRT privilege escalation (CVE-2015-5287), Ajax.NET Professional deserialization (CVE-2021-23758), and a Linux kernel out-of-bounds write flaw (CVE-2022-0995). CISA established an August 29 remediation deadline for the Citrix and Microsoft SQL vulnerabilities for affected federal entities, with remaining flaws slated for mitigation by September 9. Historical context notes this follows rapid exploitation of another NetScaler flaw, CVE-2026-8451, earlier in the year.
Read more about CISA Updates KEV Catalog as Threat Actors Target Citrix NetScaler and Legacy Enterprise Software