CISA’s alert identifies active exploitation but does not name the actors, describe the observed campaigns, or say whether the six CVEs were used together. That omission matters. Four of the six are local privilege-escalation or post-access vulnerabilities; the operational risk is very different from the Ajax.NET and NetScaler entries, which can matter at the exposed application and perimeter layers.
For WindowsForum readers, the most consequential work is to inventory SQL Server estates and older ASP.NET applications, while network teams confirm whether customer-managed NetScaler Gateway or AAA configurations have reached the fixed firmware builds.
The six KEVs are not the same kind of emergency
The newly listed vulnerabilities span software released between 2015 and 2026:
- CVE-2015-3246 is a Red Hat libuser race condition that can allow an authenticated local user to corrupt
/etc/passwdor escalate privileges to root. - CVE-2015-5287 is a local privilege-escalation flaw in Red Hat’s Automatic Bug Reporting Tool, or ABRT, involving unsafe symlink handling.
- CVE-2019-1068 is a Microsoft SQL Server remote code execution vulnerability.
- CVE-2021-23758 is an insecure deserialization vulnerability in Ajax.NET Professional that can lead to remote code execution.
- CVE-2022-0995 is an out-of-bounds write in the Linux kernel’s
watch_queuesubsystem that can let a local user gain elevated privileges. - CVE-2026-8452 is a NetScaler ADC and NetScaler Gateway memory-overflow issue affecting specific Gateway and AAA virtual-server configurations.
This is a useful reminder of what a KEV addition does — and does not — establish. CISA is saying exploitation has occurred and that defenders should prioritize remediation. It is not saying every vulnerable machine is equally reachable, nor that all six bugs are being used in a single campaign or against the same sectors.
The two 2015 Red Hat entries and the 2022 Linux kernel entry are particularly relevant after an attacker already has code execution or a low-privilege shell. A vulnerability scanner that ranks only on remote attackability could leave these behind. CISA’s addition is a reason to revisit that decision when affected Linux systems host sensitive workloads, build pipelines, web applications, or administrative tooling.
SQL Server CVE-2019-1068 needs a build-level audit
Microsoft’s July 2019 security updates describe CVE-2019-1068 as an error in how SQL Server processes internal functions. Successful exploitation permits code execution in the context of the SQL Server Database Engine service account. NVD’s record gives it a CVSS 3.0 score of 8.8 and records that low privileges are required; this is not a blanket pre-auth SQL Server takeover.
The affected Microsoft product set is older but common in long-lived enterprise environments: SQL Server 2014 Service Pack 2 and Service Pack 3, SQL Server 2016 Service Pack 1 and Service Pack 2, and SQL Server 2017. Microsoft issued fixes through the July 2019 GDR and cumulative-update tracks. SQL Server 2017 CU15, for example, carried the fix in build 14.0.3192.2.
That creates a more specific task than “patch SQL Server.” Administrators should identify instances still on the affected servicing branches, confirm their installed engine build rather than rely on the Windows patch history, and compare it with Microsoft’s SQL Server update history. An instance that was manually patched outside Windows Update, restored from an old image, or maintained under a separate DBA process can easily fall outside a general endpoint-management report.
The exploitation prerequisite should also guide incident review. Since the vulnerability requires privileges, defenders should search for unusual SQL logins, suspicious stored procedure activity, and changes made under the Database Engine service account around the period before a server was updated. CISA’s current directive language emphasizes checking for compromise before remediation in certain high-risk cases; patching is necessary, but it can also remove evidence of how an attacker got in.
For organizations with SQL Server exposed to the internet, the priority is higher still, though exposure alone does not convert this particular flaw into a no-login exploit. Reduce direct access to SQL Server ports, remove obsolete application logins, and ensure service accounts do not have more Windows privilege than the database workload requires.
Ajax.NET Professional is the Windows web-server problem
CVE-2021-23758 deserves a different response. Ajax.NET Professional, often found as the ajaxpro.2 package or as legacy AjaxPro components in ASP.NET applications, can deserialize attacker-controlled .NET types. NVD describes the result plainly: arbitrary .NET class deserialization can be abused for remote code execution.
The affected version range reaches all releases before AjaxPro 21.10.30.1, though organizations should validate against the application’s embedded library rather than assume a package manager accurately represents every deployed copy. Older ASP.NET applications are often copied between servers, deployed through ZIP archives, or retain vulnerable DLLs after a package update.
This is where conventional Windows inventory frequently fails. Endpoint tools may recognize IIS and .NET Framework, but not an obsolete third-party assembly located beneath an application’s bin directory. Application owners should search web roots, build artifacts, source repositories, and software composition analysis results for AjaxPro references. Review the application’s public routes and any methods that accept serialized JSON objects, especially where an application still exposes legacy AJAX handlers.
Updating is the correct fix, but it may not be a drop-in maintenance exercise for old applications. The hardened Ajax.NET Professional releases added more restrictive custom-type deserialization controls. Teams should test business functions that rely on custom .NET types after updating, then remove broad type allowlists rather than recreating the unsafe behavior in configuration.
Cisco Talos recently reported that a threat actor it tracks as UAT-10147 has used CVE-2021-23758 among known public vulnerabilities in attacks on servers. Talos did not establish that its activity is the basis for CISA’s August 26 listing, and CISA has not attributed the KEV addition. The overlap is still practical evidence that AjaxPro should not be dismissed as an obscure dependency with only theoretical risk.
NetScaler CVE-2026-8452 has a configuration gate
Cloud Software Group’s NetScaler advisory says CVE-2026-8452 is a memory-overflow vulnerability that can lead to unpredictable behavior or denial of service. It applies when NetScaler ADC or NetScaler Gateway is configured as a Gateway — including SSL VPN, ICA Proxy, CVPN, or RDP Proxy — or as an AAA virtual server.
The vendor’s advisory rates the flaw at 8.8 under CVSS 4.0 and directs customers to upgrade to NetScaler ADC and Gateway 14.1-72.61 or later, or 13.1-63.18 or later. The FIPS and NDcPP branches have their own fixed build: 14.1-72.61 FIPS and 13.1-37.272, respectively.
CISA’s catalog entry labels the issue as an improper restriction of operations within a memory buffer. That broader weakness classification should not obscure the operational detail in NetScaler’s bulletin: only certain appliance roles are in scope. A load-balancing-only deployment does not meet the stated precondition for CVE-2026-8452 merely because it runs an affected firmware train.
NetScaler administrators can check for an AAA virtual server by reviewing configuration for add authentication vserver, and for a Gateway configuration by checking for add vpn vserver. Cloud Software Group also states that Citrix-managed cloud services and Citrix-managed Adaptive Authentication are updated by the provider; the bulletin applies to customer-managed ADC and Gateway appliances, including NetScaler instances used in Secure Private Access Hybrid deployments.
The vendor does not state in its June 30 bulletin that CVE-2026-8452 was under active exploitation. CISA’s August 26 KEV addition changes the remediation priority for affected customer-managed appliances, but it does not provide public indicators of compromise or exploitation telemetry. Preserve appliance logs and configuration backups before upgrading, particularly where an internet-facing Gateway provides remote access.
Linux remediation needs to include the long tail
CVE-2022-0995 affects Linux kernel versions from 5.8 through before 5.10.106, from 5.11 through before 5.15.29, and from 5.16 through before 5.16.5, along with early 5.17 release candidates. It is a local out-of-bounds write in the watch_queue event-notification subsystem. NVD says it can overwrite kernel state, enabling privilege escalation or denial of service.
The Red Hat flaws are older still. Red Hat’s libuser advisory said CVE-2015-3246 affected all libuser versions shipped with Red Hat Enterprise Linux 6 and 7, with fixes delivered through RHSA-2015:1482 and RHSA-2015:1483. Its ABRT updates addressed CVE-2015-5287 in late 2015.
The age of these flaws is precisely the point. A current endpoint may be safe while an unmaintained appliance, container image, offline repository, virtual machine template, or recovery image preserves the old package. Security teams should include golden images and build systems in the investigation, not merely active production hosts.
For the six new KEVs, CISA has supplied an exploitation signal, but the most useful response is still asset-specific: patch the exposed application paths first, verify legacy SQL Server builds, upgrade affected NetScaler Gateway and AAA deployments, and treat the Linux privilege-escalation flaws as evidence that a partial compromise can become full host control.
