Six New KEV Entries: Citrix NetScaler ADC and NetScaler Gateway and What Else CISA Flagged

On 2026-08-26 CISA added six entries to the Known Exploited Vulnerabilities (KEV) catalog, capping a week that had already brought Gitea, Oracle HTTP Server, Zimbra, TrueConf Server, and MLflow into scope. KEV inclusion is not a hypothetical rating. It is CISA's assertion that the flaw is being exploited in the wild, that federal civilian agencies must patch inside a fixed deadline under BOD 22-01, and that every other organization should treat the entry as a prioritization signal that outweighs a CVSS score. This post covers the additions in order of blast radius, explains what triggered CISA's judgment where the source material tells us, and gives blue teams a concrete checklist for the two-week remediation window.

The lead: CVE-2026-8452 in NetScaler ADC and NetScaler Gateway

The 2026-08-26 headline is CVE-2026-8452, an improper restriction of operations within the bounds of a memory buffer in Citrix NetScaler ADC and NetScaler Gateway that produces denial of service. NetScaler appliances sit at the north-south edge of a large fraction of enterprise networks, terminating VPN, ICA proxy, and web application traffic; a reliable DoS against that surface is a live incident, not a bug-tracker item. CISA's decision to add the CVE to KEV rather than merely bulletin it means the agency has evidence of exploitation in the wild.

Two operational realities matter here. First, NetScaler CVEs over several years tend to start as "narrow" impact (DoS, information disclosure) and later get chained or upgraded once researchers publish. Assume the entry that reads "denial of service" today is the visible corner of a larger issue by next quarter. Second, the appliances often terminate authentication for downstream systems, so an attacker who forces a failover or a management-plane crash frequently gets a window into session state and pending auth material during the recovery.

Practical detection starts at the appliance. Pull the running build and compare it to the fixed build listed in Citrix's advisory for the CVE, then examine the management-plane logs for malformed requests that trigger the buffer condition. A minimal triage loop:

# Inventory: which appliances are in-path and what firmware are they on?
for host in $(cat netscaler-hosts.txt); do
  ssh nsroot@"$host" 'show version; show ns hardware' \
    | tee "artifacts/${host}.version.txt"
done

# Hunt: sudden ns.log restarts, watchdog resets, or PPE core dumps
grep -E 'PPE-.* (restart|panic|watchdog)|nsppe.* died' /var/log/ns.log*

# Exposure: is the management interface reachable from anything but jump hosts?
nmap -Pn -p 22,80,443,3008,3009 --script=banner <mgmt-cidr>

If you cannot patch in the window, restrict the management plane to a bastion CIDR, disable any authentication virtual servers you do not need, and rate-limit the affected data-plane endpoints at an upstream reverse proxy.

Kernel: CVE-2022-0995 in the Linux watch queue

CVE-2022-0995 is an out-of-bounds write in the Linux kernel that lets a local user escalate privileges or crash the box. The KEV addition four years after publication is a reminder that older Linux LPEs remain the practical follow-on to any web-app or supply-chain foothold. Long-lived nodes (bare-metal database servers, jump boxes, build agents) that skipped kernel bumps for application-compatibility reasons are exactly the population that gets popped after an initial-access CVE fires. Run a kernel-version sweep against your CMDB and rank by uptime; the boxes that have not rebooted since 2023 are the target set.

AjaxPro deserialization: CVE-2021-23758

CVE-2021-23758 is a .NET deserialization flaw in Ajax.NET Professional (AjaxPro) that yields RCE via arbitrary .NET classes. CISA flags the product as potentially end-of-life or end-of-service and advises discontinuation. The realistic threat model is not "we still install AjaxPro." It is "some ASP.NET application we inherited in an acquisition still ships an ajaxpro/*.ashx handler under an IIS site nobody has audited in a decade." Grep your web-tier deployment artifacts:

find /inetpub /var/www -iname '*.ashx' -o -iname 'web.config' \
  | xargs grep -l -iE 'ajaxpro|AjaxPro\.HttpHandler'

If a hit is genuinely load-bearing, isolate it behind a WAF rule that blocks the AjaxPro request path and set a hard deprecation date.

Microsoft SQL Server: CVE-2019-1068

CVE-2019-1068 is an RCE in Microsoft SQL Server that runs in the context of the SQL Server Database Engine service account. SQL Server RCE is a full-stack outcome: the service account frequently has domain reach, filesystem write to shares, and linked-server credentials in memory. If you cannot immediately apply the fix, move the service account off any privileged group it should never have belonged to, and audit xp_cmdshell and sp_OACreate state across the estate.

Red Hat local privilege escalations: CVE-2015-5287 and CVE-2015-3246

Two 2015 Red Hat local-privilege-escalation issues also landed in the 2026-08-26 batch. CVE-2015-5287 is a symlink attack on a predictable filename in ABRT, and CVE-2015-3246 is a race condition in libuser that lets a local authenticated user corrupt /etc/passwd. Both are LPE, both affect end-of-life products in most fleets, and both are the "second-stage after phishing lands on a jump host" primitive that mid-tier ransomware crews still lean on. Inventory RHEL/CentOS 6 and 7 stragglers, mark abrt-* and libuser for removal where the application does not require them, and confirm your endpoint tooling alerts on unexpected writes to /etc/passwd.

The wider week: Gitea, Oracle, Zimbra, TrueConf, MLflow

The five additions in the days before 2026-08-26 round out an ugly picture for anyone running developer or collaboration infrastructure:

Working the two-week deadline

BOD 22-01 gives federal agencies roughly two weeks to remediate a KEV entry once it lands. Private-sector teams should mirror the discipline. A workable playbook:

  1. Identify and inventory. Map each of the twelve CVEs to concrete asset classes in your CMDB before you touch a patch console. If you cannot answer "how many NetScaler pairs, which build, which VIPs" in an hour, that is the finding.
  2. Compensating controls first. Push firewall rules, WAF signatures, and management-plane ACLs the same day the KEV entry lands. Patching is next; blocking exposure is now.
  3. Exploit-aware detection. For each CVE, write or import a specific detection: NetScaler PPE crashes, Gitea diffpatch requests followed by hook file writes, Zimbra zmmta shelling out to sh, MLflow SSRF response bodies matching 169.254.169.254.
  4. Verification. Re-scan after patching. A ticket closed on "vendor patch applied" without a version-string re-check is a ticket that lies to you at audit time.

The KEV catalog collapses a noisy vulnerability firehose into a short list of what adversaries actually use. Treat each entry as a live incident precursor, not a reading assignment.

Verifiable security.