← News
/DISPATCH · 2026-08-28

CISA KEV Adds 6 Flaws: Citrix NetScaler OOB Memory Attempted 36 Times in 12 Days

On 27 August 2026, CISA added six in-the-wild vulnerabilities to the KEV catalog. Citrix NetScaler ADC/Gateway CVE-2026-8452 (OOB memory) saw 36 exploitation attempts in 12 days; attackers dropped x.php and z.php WebShells. CISA requires FCEB agencies to patch NetScaler and SQL Server by 29 August, the rest by 9 September.

Incident Overview

On 27 August 2026, CISA added six actively exploited vulnerabilities to the KEV catalog in one batch, covering edge gateway devices, OS kernels, and critical middleware across enterprise remote access, database management, and Web components. Federal Civilian Executive Branch (FCEB) agencies must:

Defused Cyber, Previdian (formerly KEVIntel), and other threat-intel vendors concurrently disclosed 36 exploitation attempts against NetScaler CVE-2026-8452 over the past 12 days. Source IPs spanned Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Turkey, the United States, and Vietnam. Attackers already dropped WebShells named `x.php` and `z.php` on compromised hosts and ran reconnaissance commands including `id` and `echo`.

Technical Details

CVE-2026-8452: Citrix NetScaler ADC / Gateway Out-of-Bounds Memory Operation

The flaw is an improper restriction on out-of-bounds memory-buffer operations when ADC / Gateway handles certain requests. CVSS v4 score 8.8. Can cause unpredictable behavior and denial of service on the gateway or AAA virtual server. Citrix released fixed versions:

`NetScaler 14.1  upgrade to 14.1-72.61
NetScaler 13.1  upgrade to 13.1-63.18
`

CVE-2026-8452 is a different bug from CVE-2026-19490 (NetScaler SAML auth bypass, CVSS 9.3) disclosed earlier this month. This is a standalone OOB memory issue. Hosts that already took the August SAML patch still need this upgrade.

CVE-2019-1068: Microsoft SQL Server Remote Code Execution

RCE in the SQL Server database engine service-account context. Attackers can fully control the database instance. Microsoft shipped security updates in 2019; ransomware crews still treat it as a high-value known entry. CISA says no public exploit details are available, but the patch has long been available and exposure remains common. CISA's advisory is explicit: do not delay because the patch looks old. KEV listing means it is already abused in ransomware chains.

CVE-2022-0995: Linux Kernel watch_queue Out-of-Bounds Write

OOB memory write in the kernel `watch_queue` subsystem. Local users can gain privileges or trigger denial of service. Fixed for years in stable kernels of major distros, but a long tail of unpatched servers (embedded, industrial endpoints, CI runners) is still found and exploited by automated scanners.

CVE-2015-5287 + CVE-2015-3246: Red Hat ABRT and libuser Legacy Flaws

ABRT (Automatic Bug Reporting Tool) local privilege escalation via symlink. Red Hat libuser race condition when handling `/etc/passwd`, leading to local DoS or privilege escalation. Both are old CVEs. Cisco Talos reports UAT-10147 (Chinese-language threat group) continues to exploit these legacy bugs against Windows and Linux Web servers worldwide, hence today's KEV listing.

CVE-2021-23758: Ajax.NET Professional Deserialization

Deserialization of untrusted data in the Ajax.NET Professional (AjaxPro) library. RCE via arbitrary .NET classes. Together with the recent `Shai-Hulud` npm worm and IJWT attacks, a reminder that stale .NET / Java / Node components remain ransomware favorites.

Impact Assessment

These six additions span the edge → host → database stack. Any unpatched exposure can be chained:

CISA's concurrent *2024-2025 Vulnerability Root Cause Analysis* notes injection defects: 7,701 CVEs in 2024, 21,019 in 2025. Memory-safety and input-validation flaws appear in KEV at a higher rate than in the full CVE corpus. Attackers are not hunting the hardest bugs; they eat the most forgotten patches.

Remediation

Immediate actions (per FCEB deadlines)

Shrink the attack surface

Detection and alerting

References