Security update • CISA KEV
CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on August 26, confirming evidence of real-world exploitation.[1] The group spans NetScaler, Microsoft SQL Server, Ajax.NET Professional, Linux kernel, Red Hat libuser and Red Hat ABRT deployments.[1] CISA lists known ransomware-campaign use as Unknown for all six.[1]
August 29
NetScaler CVE-2026-8452 and SQL Server CVE-2019-1068.[1]
September 9
AjaxPro, libuser, ABRT and Linux kernel entries.[1]
These dates are CISA remediation deadlines under federal operational directives, not universal legal deadlines for every private organization.[1] KEV inclusion confirms known exploitation, but CISA’s entries do not identify victims, attackers, campaign volume, first-observed dates or successful exploitation at any particular organization.[1]
What changed in CISA’s catalog
CISA’s catalog version 2026.08.26 added all six records on August 26.[1] The two August 29 entries are network-reachable flaws affecting specific NetScaler configurations and affected SQL Server branches; the remaining four involve a web application component or local Linux/Red Hat exposure.[1][6][8]
The six vulnerabilities at a glance
| CVE and product | Exposure boundary | CISA date | Defensive priority |
|---|---|---|---|
| CVE-2026-8452 NetScaler ADC/Gateway |
Unauthenticated network memory corruption when configured as Gateway—such as SSL VPN, ICA Proxy, CVPN or RDP Proxy—or as an AAA virtual server.[6] | August 29[1] | Inventory exposed appliances and match the exact branch to current Citrix instructions before change approval.[1][6] |
| CVE-2019-1068 Microsoft SQL Server |
CISA says exploitation can execute code in the SQL Server Database Engine service-account context.[1] NVD’s current CVSS 3.1 vector classifies the flaw as network-reachable and requiring low privileges.[8] | August 29[1] | Identify the exact SQL Server branch and apply Microsoft’s matching security update; do not substitute a patch from another branch.[1][7] |
| CVE-2021-23758 Ajax.NET Professional / AjaxPro.2 |
Unsafe deserialization of attacker-controlled data can instantiate arbitrary .NET classes and lead to remote code execution.[2] | September 9[1] | Search application dependencies and ownership records; this component may not appear as a standalone installed program.[1][2] |
| CVE-2015-3246 Red Hat libuser/userhelper |
An authenticated local user can corrupt /etc/passwd, causing denial of service; the issue can combine with CVE-2015-3245 for privilege escalation.[3] |
September 9[1] | Use the distribution advisory and package provenance rather than upstream version comparison alone.[1][3] |
| CVE-2015-5287 Red Hat ABRT |
A local user with required permissions can exploit predictable-file symlink handling to gain privileges.[4] | September 9[1] | Confirm ABRT package status and vendor backports across inventoried systems.[1][4] |
| CVE-2022-0995 Linux kernel watch_queue |
A local low-privilege user can trigger an out-of-bounds kernel write, potentially gaining privileged access or causing denial of service.[5] | September 9[1] | Classify by distribution kernel package and backport status—not the upstream kernel number alone.[1][5] |
Why NetScaler and SQL Server come first
The shorter CISA date and network reachability make the NetScaler and SQL Server records the first inventory priority.[1][6][8] NetScaler exposure still requires one of the configurations named in the CVE record; SQL Server exploitation requires low privileges rather than no authentication.[6][8]
That distinction matters: “network-reachable” does not mean every installation is internet-facing, and KEV inclusion does not prove a specific appliance or database was compromised.[1][6][7]
Four entries are a material follow-on, not six new site topics
Four entries—libuser, ABRT, Linux kernel watch_queue and AjaxPro—appeared in our earlier UAT-10147 coverage.[9] Their new material change is CISA KEV inclusion plus the September 9 federal remediation date.[1] NetScaler CVE-2026-8452 and SQL Server CVE-2019-1068 are the two additions not found in that earlier article.[9][1]
A safe inventory order
- List NetScaler ADC/Gateway appliances and record exact configuration, release branch and exposure path.[6]
- List SQL Server instances, exact GDR/CU branch, reachable interfaces and service-account context.[7]
- Ask application owners to identify AjaxPro/Ajax.NET Professional dependencies, including bundled or legacy applications.[2]
- Classify Linux and Red Hat systems by vendor package/advisory status for the kernel, ABRT and libuser—not by upstream versions alone.[3][4][5]
If compromise is suspected
Preserve relevant authentication, process, crash, database, appliance and security logs before cleanup, and coordinate containment and evidence collection through the approved incident-response process.[1] Do not run public exploit code against production or third-party systems.[1] Patching closes a known entry point but does not establish that a previously exposed system is clean.[1]
What remains unknown
- CISA lists ransomware-campaign use as Unknown for all six.[1]
- The KEV entries do not identify attackers, victims, exploitation volume or first-observed dates.[1]
- This article does not claim any local organization is exposed or compromised.
Bottom line
Treat this as one grouped CISA event with six different exposure predicates—not six identical emergencies.[1] Start with correctly configured, reachable NetScaler appliances and affected SQL Server branches, then complete dependency and distribution-aware review of AjaxPro, libuser, ABRT and Linux kernel systems.[1][6][8] Keep CISA’s federal dates visible without presenting them as universal private-sector deadlines.[1]
Sources
- CISA — Known Exploited Vulnerabilities catalog JSON
- CVE Program — CVE-2021-23758
- CVE Program — CVE-2015-3246
- CVE Program — CVE-2015-5287
- CVE Program — CVE-2022-0995
- CVE Program — CVE-2026-8452
- CVE Program — CVE-2019-1068
- NVD — CVE-2019-1068 CVSS record
- The IT Guys — earlier UAT-10147 coverage of four overlapping CVEs
Reporting cutoff: August 26, 2026, 9:41 PM EDT / 2026-08-27T01:41:55Z. CISA and vendor records can change after publication; verify the current catalog and exact vendor branch before remediation.