Six Additions, Two Different Deadlines
CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on August 26, splitting them into two remediation windows based on how urgently each is being weaponized in the wild. CVE-2019-1068, a Microsoft SQL Server remote code execution flaw, and CVE-2026-8452, a Citrix NetScaler ADC and Gateway denial-of-service vulnerability, carry an August 29 deadline for federal civilian agencies, giving patch teams roughly three days from the catalog addition to close the gap. The remaining four vulnerabilities get a longer window, until September 9, reflecting a lower but still confirmed level of active exploitation against those components.
The two-tier structure signals which flaws CISA considers the more immediate exposure for federal networks right now. NetScaler appliances sit at the network edge in most enterprise deployments, handling authentication and traffic management for everything behind them, which makes a denial-of-service bug there more consequential than its severity score alone might suggest. Availability loss on an authentication gateway can cascade into outages well beyond the appliance itself, taking down VPN access, load balancing, and single sign-on for an entire organization at once during business hours.
A Live Exploitation Campaign Against NetScaler
The NetScaler vulnerability is not a theoretical addition to the catalog. CISA's entry reflects active, ongoing exploitation, with attackers planting web shells named x.php and z.php on compromised appliances to maintain persistent access after the initial denial-of-service condition is triggered. Researchers logged 36 distinct exploitation attempts against monitored instances over a 12-day window, evidence of a sustained, methodical scanning and exploitation campaign rather than an isolated proof-of-concept incident that got lucky against a single unpatched target.
Organizations running NetScaler ADC or Gateway at internet-facing edges should treat this addition as an incident response trigger rather than a routine patch cycle line item to schedule for next sprint. Checking logs for the named web shell indicators is a task measured in minutes, costs nothing beyond analyst time, and directly catches the specific campaign CISA is responding to here. Waiting for the standard change management cycle on an appliance already confirmed under active attack is the wrong call given what is already documented.
The Decade-Old Bugs Doing New Damage
The more unusual story in this batch is the four vulnerabilities CISA attributes to a threat group tracked as UAT-10147. Two are Red Hat components, CVE-2015-5287 in ABRT and CVE-2015-3246 in libuser, both more than a decade old and long since assumed irrelevant by most vulnerability management programs still tracking severity by disclosure recency. A third, CVE-2021-23758 in Ajax.NET Professional, is a deserialization flaw from 2021 affecting a library many enterprise applications embed without direct visibility into the dependency. The fourth, CVE-2022-0995, is a Linux kernel out-of-bounds memory write.
None of these individually reads as a headline vulnerability today, and each would likely sit near the bottom of a typical remediation backlog if evaluated in isolation against newer, flashier CVEs. What makes the addition notable is that UAT-10147 is actively chaining them together in sequence, using the older bugs for privilege escalation and lateral movement once initial access is established through some other means entirely. A chain built from components most patch programs assumed were closed years ago still produces a fully working intrusion path against any environment that never finished retiring the affected packages from production.
Why Legacy Components Keep Reappearing on the KEV List
Vulnerabilities from 2015 landing on an active exploitation list in 2026 is not an anomaly specific to this advisory. It is a recurring pattern that reflects how enterprise environments actually age in practice: components get deprecated on paper long before they are fully decommissioned in production, and privilege escalation bugs buried in low-visibility packages rarely make it onto a CISO's remediation dashboard next to the headline CVEs that generate press coverage and vendor advisories with urgent subject lines.
Attackers exploit exactly that visibility gap, and UAT-10147's approach here is a clean illustration of the strategy. A group does not need a fresh zero-day for every stage of an intrusion to succeed. It needs one reliable initial access vector plus a handful of older, less-monitored bugs to escalate privileges from there, and legacy Linux distributions running unpatched Red Hat components turn out to be an efficient, well-documented place to find exactly those bugs at scale across thousands of potential targets.
What This Means for Patch Governance
The practical lesson for enterprise security teams is that patch prioritization frameworks weighted purely by CVSS score or disclosure recency will miss chains like this one entirely. A 2015 privilege escalation bug with a moderate severity rating looks unremarkable when reviewed in isolation on a vulnerability scanner report. Its real risk only becomes visible when correlated against what else is reachable from the same host, which requires asset inventory discipline that most organizations still lack for anything outside their handful of designated crown-jewel systems.
This is also a supply chain argument in miniature, even though none of these six vulnerabilities involves a compromised software update. Every unpatched Red Hat or Linux kernel component sitting in a forgotten VM or container base image is a latent liability that a sufficiently patient threat group will eventually find a productive use for. CISA naming UAT-10147's specific chain publicly gives defenders a rare, concrete map of what to hunt for in their own environments, rather than the usual generic reminder to simply patch everything eventually.
The Immediate Checklist
For teams running any of the six affected products, the sequence is straightforward and worth acting on this week rather than deferring to the next maintenance window. Patch NetScaler and SQL Server first against the August 29 federal deadline, check for the named web shell indicators on any internet-facing NetScaler instance regardless of patch status, and inventory whether the four legacy Linux and Red Hat components are present anywhere in your environment before the September 9 window closes on the remaining flaws.
For everyone else not directly exposed to these six CVEs, the broader takeaway is to run an audit of end-of-life or deprecated packages still running quietly in production, particularly anything inherited through acquisitions or legacy infrastructure that predates your current security tooling and monitoring stack. UAT-10147 is proof that a patient, well-resourced attacker will eventually find and chain exactly those forgotten components together, and the fix is considerably cheaper before that happens than after an intrusion is already underway.
