CISA Adds Six Exploited Flaws to KEV, Including Net Scaler, Linux, and SQL Server Bugs

Summary: CISA added six flaws to its Known Exploited Vulnerabilities catalog on Wednesday, including a high-severity Citrix NetScaler ADC and NetScaler Gateway vulnerability, citing evidence of active exploitation. Previdian reported attackers dropping web shells named 'x.php' and 'z.php' and running discovery commands, with telemetry showing 36 exploitation attempts over 12 days from 12 unique IP addresses across Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., and Vietnam.
Why it matters: CISA set deadlines of August 29, 2026 for CVE-2019-1068 and CVE-2026-8452 and September 9, 2026 for the rest, and its own review counted 7,701 injection CVEs in 2024 rising to 21,019 in 2025 - the same weakness class it says threat actors are now exploiting with AI-driven automation.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2015-3246 CVE-2015-5287 CVE-2019-1068 CVE-2021-23758 CVE-2022-0995 CVE-2026-8452
Related: UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit Cyber Risks ·
CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Aug 26, 2026
CVE-2026-8452: Citrix Net Scaler ADC and Net Scaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Known Exploited Vulnerabilities · Aug 26, 2026