Loading story…
CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation affecting Citrix NetScaler ADC and Gateway, Microsoft SQL Server, Ajax.NET Professional, the Linux kernel, Red Hat ABRT, and Red Hat libuser. The additions include CVE-2026-8452, a high-severity NetScaler memory-buffer vulnerability reportedly used for web-shell deployment and reconnaissance activity; internet-facing NetScaler appliances, SQL Server instances, and applications using Ajax.NET Professional are priority targets for exposure review, patching, and compromise hunting.
The older Linux and Red Hat vulnerabilities can enable local privilege escalation following an initial compromise, increasing their operational significance despite their age. CISA directed U.S. federal civilian agencies to remediate CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the other four KEV entries by September 9; organizations should similarly prioritize remediation according to confirmed exploitation, internet exposure, asset criticality, and potential business impact.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-8452, CVE-2019-1068, CVE-2021-23758, CVE-2015-3246, CVE-2015-5287, and CVE-2022-0995 to its Known Exploited Vulnerabilities Catalog after identifying evidence of active exploitation. The flaws affect Citrix NetScaler, Microsoft SQL Server, Ajax.NET Professional, Red Hat libuser and ABRT, and the Linux kernel.
Citrix disclosed CVE-2026-8452, a memory-overflow vulnerability affecting NetScaler ADC and Gateway appliances, and released fixes in versions 14.1-72.61, 13.1-63.18, and 13.1-37.272. Citrix said at disclosure that it had not observed unmitigated exploitation.
WatchTowr research indicated that the NetScaler memory-overflow flaw CVE-2026-8452 may permit unauthenticated remote code execution. Exploitation requires vulnerable firmware and an appliance configured with a NetScaler Gateway or AAA virtual server.
Open-source reporting cited by the Guyana National CIRT indicated that CVE-2026-8451, affecting Citrix NetScaler products, was being exploited. The reference also reiterated that CVE-2026-8452 was exploited in the wild.
Brazil's CTIR Gov issued ALERTA 76/2026 concerning the actively exploited Microsoft SQL Server vulnerability CVE-2019-1068, which can permit arbitrary code execution. The alert urged organizations, including those in Brazil's REGIC network, to identify affected deployments and immediately apply vendor security updates.
CISA directed U.S. Federal Civilian Executive Branch agencies to remediate the Microsoft SQL Server and Citrix NetScaler vulnerabilities by August 29, 2026, and the Linux kernel, Red Hat ABRT, Red Hat libuser, and Ajax.NET Professional vulnerabilities by September 9, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
11 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcethehackernews.com
Open sourcethecyberthrone.in
Open sourcecirt.gy
Open sourcegov.br
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **five vulnerabilities** to its **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of **active exploitation**, reinforcing that these issues are being used as real-world attack vectors and should be prioritized for remediation. The newly listed CVEs are **CVE-2018-14634** (Linux kernel integer overflow / local privilege escalation), **CVE-2025-52691** (SmarterTools *SmarterMail* unrestricted file upload enabling RCE), **CVE-2026-21509** (Microsoft Office security feature bypass), **CVE-2026-23760** (SmarterTools *SmarterMail* authentication bypass via alternate path/channel), and **CVE-2026-24061** (GNU *InetUtils* argument injection). CISA reiterated that these vulnerability classes are frequently leveraged by threat actors and pose material risk to enterprise environments. Under **BOD 22-01**, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities by CISA-specified due dates, and CISA urged all organizations to treat KEV entries as high-priority items in vulnerability management. Additional technical context highlighted that **CVE-2025-52691** can enable unauthenticated arbitrary file upload leading to **remote code execution** (noted as **CVSS 10.0** in the reporting) and that **CVE-2018-14634**, while older, remains relevant where legacy Linux kernels persist—underscoring that KEV additions can include long-standing flaws when exploitation is observed in the wild.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are currently under active exploitation. The vulnerabilities include CVE-2021-21311 affecting Adminer, CVE-2025-20352 impacting Cisco IOS and IOS XE, CVE-2025-10035 in Fortra GoAnywhere MFT, CVE-2025-59689 in Libraesva Email Security Gateway, and CVE-2025-32463 in Sudo. The Adminer flaw is a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate URL parameters, potentially enabling unauthorized access to internal resources and facilitating lateral movement within networks. The Cisco IOS and IOS XE vulnerability is a stack-based buffer overflow in the SNMP subsystem, which can be exploited by sending crafted SNMP packets, leading to denial of service or remote code execution as root, depending on attacker privileges. Fortra GoAnywhere MFT is affected by a critical deserialization vulnerability in its License Servlet, which could allow attackers to execute arbitrary code. Libraesva ESG suffers from a command injection vulnerability, and Sudo is impacted by a flaw involving the inclusion of functionality from an untrusted control sphere. CISA’s Product Security Incident Response Team (PSIRT) has confirmed that these vulnerabilities are being actively exploited in the wild. The addition of these flaws to the KEV Catalog is based on credible evidence of exploitation, and CISA has issued a Binding Operational Directive (BOD) 22-01 requiring Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by specified deadlines. The directive aims to reduce significant risk to federal networks, but CISA also strongly urges all organizations, not just federal agencies, to prioritize remediation of these vulnerabilities as part of their vulnerability management programs. The vulnerabilities span a range of critical systems, including database management tools, network operating systems, email security gateways, and managed file transfer platforms, highlighting the broad attack surface targeted by malicious actors. The Adminer SSRF vulnerability, with a CVSS score of 7.2, affects versions 4.0.0 to just before 4.7.9, while the Cisco IOS/IOS XE flaw, with a CVSS score of 7.7, impacts all devices with SNMP enabled. The Fortra GoAnywhere MFT vulnerability is rated as critical with a CVSS score of 10.0, underscoring the urgency of remediation. CISA’s ongoing updates to the KEV Catalog reflect the evolving threat landscape and the need for organizations to remain vigilant against actively exploited vulnerabilities. Organizations are encouraged to consult the KEV Catalog regularly and implement timely patches to mitigate the risk of compromise. The inclusion of these vulnerabilities in the KEV Catalog serves as a warning to both public and private sector entities about the heightened risk posed by these flaws. Failure to address these vulnerabilities could result in significant operational disruptions or unauthorized access to sensitive systems. CISA’s alert emphasizes the importance of proactive vulnerability management and cross-sector collaboration to defend against active cyber threats.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2024-43468** to its Known Exploited Vulnerabilities (KEV) catalog after determining the flaw is being **actively exploited in the wild**. The vulnerability is a **critical (CVSS 9.8) SQL injection** in *Microsoft Configuration Manager* (ConfigMgr/SCCM) that can allow an **unauthenticated remote attacker** to achieve **remote code execution** by sending specially crafted requests, enabling command execution on the ConfigMgr server and/or its underlying site database with **high/`SYSTEM`-level impact**. CISA set a remediation deadline of **March 5** for U.S. Federal Civilian Executive Branch agencies under its Binding Operational Directive requirements; public reporting noted Microsoft’s advisory had previously assessed exploitation as “less likely,” and Microsoft had not (as of reporting) publicly detailed the threat actors or scope of exploitation. The issue was originally patched by Microsoft in **October 2024** after being reported by **Synacktiv**, and proof-of-concept exploit code was later published (including by Synacktiv), lowering the barrier to weaponization. Separate CISA KEV updates the same week also drove patching urgency across other widely deployed products (including **SolarWinds Web Help Desk** and multiple **Apple** platforms for a reportedly “extremely sophisticated” targeted attack), reinforcing that organizations should treat KEV additions as a high-confidence signal to accelerate patching and exposure reduction—particularly for internet-reachable management tooling like ConfigMgr that can provide broad administrative control if compromised.
Jun 29, 2026