CISA adds NetScaler and SQL Server flaws to KEV

CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on August 26, 2026, per its alert. CISA carries the headline NetScaler bug as a denial-of-service issue, not remote code execution, even though a researcher says it is worse. The agency names no threat actor for any of the six.

Two of the six carry an accelerated deadline. Federal civilian agencies must remediate them by August 29 under Binding Operational Directive 26-04.

CVE-2026-8452, in Citrix NetScaler ADC and Gateway, is the one drawing the argument. CISA describes it as a memory-buffer flaw that could lead to denial of service, and its forensic-triage flag for the entry is set to no. That framing traces to Citrix, which in June characterized the issue as denial of service and unpredictable behavior.

watchTowr has since demonstrated exploitation yielding remote code execution as root, and active attacks are dropping web shells on appliances. CISA has not adopted the RCE label. It kept the DoS wording. Fixed builds per Citrix's advisory (CTX696604) start at 14.1-72.61 and 13.1-63.18, with matching FIPS and NDcPP builds. The bug bites appliances configured as a Gateway VPN or AAA virtual server.

CVE-2019-1068, a Microsoft SQL Server remote code execution flaw, is the other August 29 item, and its triage flag is set to yes. The year is the story: this is a 2019 authenticated RCE that runs in the SQL service-account context, not a fresh zero-day. It sat patchable for seven years and is only now being exploited in the wild.

The remaining four are due September 9, and every one is old: CVE-2015-3246 (Red Hat libuser race condition), CVE-2015-5287 (Red Hat ABRT), CVE-2021-23758 (Ajax.NET Professional deserialization), and CVE-2022-0995 (Linux kernel watch_queue out-of-bounds write). Two are a decade old. The pattern in this batch is attackers monetizing long-patched Linux and application bugs on hosts nobody updated, which is why four of the six are privilege-escalation and application flaws, not perimeter appliances.

CISA gives no victim count, but the attack surface is countable. Shadowserver telemetry, via BleepingComputer, puts roughly 22,000 NetScaler ADC appliances and about 1,800 Gateway instances reachable on the public internet, patch status unknown.

CVE-2026-8452 is a separate bug from the NetScaler CVE-2026-19490 covered last week. Patching one does not close the other.

Some offers on this page may be paid placements or contain affiliate links.