CISA Adds Six Known Exploited Vulnerabilities to Catalog
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability CVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of
CSIRTS triage
- What
- Six vulnerabilities across multiple vendors added to CISA's Known Exploited Vulnerabilities catalog.
- Who is affected
- Deployments running Red Hat Libuser, Red Hat ABRT, Microsoft SQL Server, Ajax.NET Professional, Linux Kernel, and Citrix NetScaler ADC/Gateway.
- Urgency
- Critical; all six are actively exploited and represent high risk to federal and enterprise networks.
- Action
- Refer to individual CVE advisories and apply available patches for each affected product.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2015-3246Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 94% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2015-5287Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 88% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2019-1068Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2021-23758Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99.8% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2022-0995Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 93% of all EPSS-scored CVEs.
- Exploitation confirmedCVE-2026-8452Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 62% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2015-3246 | coverage & exploitation status | NVD · CVE.org |
| CVE-2015-5287 | coverage & exploitation status | NVD · CVE.org |
| CVE-2019-1068 | coverage & exploitation status | NVD · CVE.org |
| CVE-2021-23758 | coverage & exploitation status | NVD · CVE.org |
| CVE-2022-0995 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-8452 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCitrix security advisory (AV26-645) – Update 3cccs
- criticalexploitedCVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerabilitycisa-kev
- criticalexploitedCVE-2021-23758: Ajax.NET Professional Deserialization of Untrusted Data Vulnerabilitycisa-kev
- criticalexploitedCVE-2015-3246: Red Hat Libuser Race Condition Vulnerabilitycisa-kev
- criticalexploitedCVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerabilitycisa-kev
- criticalexploitedCVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-8452: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds…cisa-kev
- unknownNCSC-2026-0216 [1.01] [M/H] Vulnerabilities Fixed in Citrix Netscaler ADC and Netscaler Gatewayncsc-nl
- unknownCitrix Products Multiple Vulnerabilitieshkcert
- unknownAL26-016 - Vulnerability impacting Citrix NetScaler CVE-2026-8451cccs
- high[UPDATE] [high] Citrix Systems NetScaler ADC and Gateway: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Citrix products (July 1, 2026)cert-fr-avis
More from CISA Cybersecurity Advisories
- criticalCISA Vulnerability Review2026-08-26
- criticalFURUNO FA-50 Class B AIS Transponder2026-08-25
- criticalRently Smart Home2026-08-25
- criticalA Tale of Two SOCs: Insights From Two Red Team Assessments2026-08-25
- criticalSiemens SIMATIC IoT2050 Advanced2026-08-25