CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 26, 2026, meaning all six have confirmed evidence of active exploitation, not just theoretical risk. Federal agencies are required to patch KEV entries by a set deadline; everyone else isn’t required to, but the KEV list is one of the more reliable real-world signals of what attackers are actually using right now, as opposed to what merely scores high on a severity chart.
What’s Actually on the List
The headline entry is CVE-2026-8452, a memory-buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can cause denial of service, notable partly because it’s being actively exploited even after Citrix’s own patch was already available, a pattern that shows up often enough to be worth internalizing: a released patch doesn’t mean the threat is over, only that it’s now the administrator’s job to apply it. The list also includes CVE-2022-0995, an out-of-bounds memory write in the Linux kernel that can let a local user escalate to privileged access or cause a denial of service, and CVE-2019-1068, a remote code execution flaw in Microsoft SQL Server. Both of those are older CVEs, from 2022 and 2019 respectively, added to the active-exploitation list now, which is a useful reminder that “old” and “not currently dangerous” aren’t the same thing; an old, unpatched vulnerability is just as exploitable today as the day it was disclosed if the fix never got applied.
What Attackers Are Actually Doing With Access
In observed exploitation tied to this batch, attackers dropped web shells named x.php and z.php and ran discovery commands, standard post-compromise reconnaissance rather than anything exotic. Telemetry showed 36 exploitation attempts over 12 days from 12 distinct attacker IPs across multiple countries, small numbers in absolute terms, but confirmed, real attempts rather than automated background noise. A dropped web shell with a generic filename is specifically designed to blend into a directory listing rather than announce itself, which is exactly why file-integrity monitoring (something that flags unexpected new files in a web root, not just logs that nobody reviews) catches this kind of compromise faster than manually eyeballing a directory ever will.
Why the Old CVEs Matter as Much as the New One
It’s tempting to read a KEV update and focus only on the newest, highest-profile entry, in this case the NetScaler flaw, since it’s the one making headlines. The two older CVEs are arguably the more useful data point for most site owners: they’re evidence that unpatched legacy vulnerabilities remain a live attack surface years after disclosure, not a closed chapter. If a server has been running the same OS image or database version for a long stretch without a real patching cadence, the actual risk isn’t limited to whatever’s newest this week, it includes everything that’s accumulated unpatched since the last time someone actually checked.
What This Means for Your Own Server
If you’re running NetScaler, Linux, or SQL Server anywhere in your stack, cross-check the specific CVEs above against your current patch level directly rather than assuming a recent update covered it, CISA’s KEV catalog entry for each CVE lists the exact affected versions and remediation deadline federal agencies are held to. Beyond this specific batch, the actual habit worth building is treating CISA’s KEV catalog as a regular check, not a one-time read: it updates as new active exploitation is confirmed, and it’s a far more targeted signal for where to spend limited patching time than trying to apply every security bulletin from every vendor with equal urgency.