The U.S. Cybersecurity and Infrastructure Security Agency has added six security flaws to its Known Exploited Vulnerabilities catalog, citing evidence that attackers are actively using them in the wild. The Wednesday update includes a high-severity issue affecting Citrix NetScaler ADC and NetScaler Gateway, according to CISA's announcement. The move reflects the agency's ongoing effort to protect federal systems from vulnerabilities that threat actors are already exploiting in real-world attacks.
The six vulnerabilities span multiple platforms and years. They include CVE-2019-1068, a remote code execution flaw in Microsoft SQL Server that lets attackers run code within the SQL Server Database Engine service account; CVE-2026-8452, an improper memory buffer restriction issue in Citrix NetScaler ADC and NetScaler Gateway that can cause denial-of-service; CVE-2022-0995, an out-of-bounds memory write problem in Linux Kernel allowing local users to gain elevated access or trigger service disruptions; CVE-2015-5287, a privilege escalation weakness in Red Hat Automatic Bug Reporting Tool that lets local users elevate privileges through a symlink attack on predictably named files; CVE-2015-3246, a race condition flaw in Red Hat libuser enabling authenticated local users to corrupt the /etc/passwd file for denial of service or privilege escalation; and CVE-2021-23758, a deserialization of untrusted data vulnerability in Ajax.NET Professional that permits remote code execution via arbitrary .NET classes. Security firms Defused Cyber and Previdian have warned of active exploitation targeting CVE-2026-8452, with Previdian noting that "the attackers were dropping a web shell named 'x.php' and 'z.php,' and running discovery commands, like 'id' and 'echo.'" Telemetry data reveals 36 exploitation attempts detected over the preceding 12 days from 12 distinct attacker IP addresses originating in Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the United States, and Vietnam.
The addition of CVE-2022-0995, CVE-2015-5287, CVE-2015-3246, and CVE-2021-23758 to the catalog follows reporting from Cisco Talos, which documented a Chinese cybercrime group designated UAT-10147 that's attacking Windows and Linux web servers worldwide across the education, media, technology, and gaming industries, according to CISA's announcement. No public information currently exists on how CVE-2019-1068 is being exploited in active attacks. CISA is directing Federal Civilian Executive Branch agencies to implement fixes for CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and for the remaining four vulnerabilities by September 9, 2026. The agency also released a new vulnerability review examining the root causes of insecure software and practical remediation steps. According to CISA's analysis of CVE records from 2024 and 2025, injection weaknesses emerged as the most dominant category, accounting for 7,701 CVEs in 2024 and 21,019 CVEs in 2025.
The agency emphasized that threat actors are exploiting simple, known software vulnerabilities that persist in exposed assets and that artificial intelligence is being used to automate exploitation efforts. "In FY2024 and FY2025, memory safety and improper input validation weaknesses appear disproportionately in KEVs compared to the full CVE population," CISA stated. The report explains that for software providers, this finding highlights the importance of addressing the underlying weaknesses that often translate directly into real-world exploitation, with the goal that reducing these root causes during software development can help prevent vulnerabilities that are more likely to be targeted by threat actors. CISA is urging federal agencies to prioritize patching before the September deadline, noting the geographically diverse origins of recent attacks and the speed at which attackers are deploying web shells to compromise systems. The tight remediation timeline reflects the agency's assessment that these aren't theoretical risks but active threats already being weaponized across multiple continents. Organizations outside the federal mandate should still treat these six vulnerabilities as urgent priorities, given that criminal groups rarely limit their targets to government networks once a reliable exploit is in hand. The confluence of older privilege escalation bugs and newer memory safety issues on a single watch list suggests attackers are methodically cataloging any exploitable entry point, regardless of age.