CISA KEV August 2026: Citrix NetScaler CVE-2026-8452 and Five Legacy Flaws Now Actively Exploited

The August 26, 2026 KEV batch

On August 26, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog based on confirmed evidence of active exploitation. The headline entry is CVE-2026-8452, a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Alongside it sit five older flaws across Red Hat Linux, Microsoft SQL Server, Ajax.NET Professional, and the Linux kernel, all confirmed as present-day attack paths rather than historical trivia.

The inclusion of legacy CVEs is instructive. CISA lists a vulnerability only when there is reliable evidence that it has been actively exploited in the wild, so any organization that deprioritized these fixes because of their age is exposed to flaws with confirmed exploitation.

CVE-2026-8452: Citrix NetScaler ADC and Gateway

Perimeter appliances sit in front of sensitive authentication and application traffic. Post-exploitation behavior against NetScaler is documented from prior campaigns: in CISA advisory AA23-201A (CVE-2023-3519), actors implanted webshells, gained root-level access, and decrypted Active Directory credentials stored in NetScaler configuration files. For CVE-2026-8452 itself, Help Net Security and the Cloud Security Alliance report that watchTowr Labs published research and proof-of-concept code on August 14, 2026 showing the flaw can be chained into unauthenticated remote code execution, beyond the denial of service Citrix described, and that attackers began dropping web shells soon after.

On a compromised appliance, the NetScaler packet processing engine (nsppe) or the management web server (httpd on MPX and VPX, nshttpd on BLX) spawning shells and interpreters is a compromise indicator.

The legacy five: old bugs, live exploitation

These are not new discoveries. They are being re-exploited today against estates that never finished patching.

• •
  CVE-2015-3246 (Red Hat libuser race condition): A race condition in libuser allows an authenticated local user to corrupt /etc/passwd, causing denial of service or privilege escalation. Detection: unexpected modification of /etc/passwd by non-administrative processes.
• •
  CVE-2015-5287 (Red Hat ABRT privilege escalation): The Automatic Bug Reporting Tool could be abused by local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name in its coredump helper (abrt-hook-ccpp).
• •
  CVE-2019-1068 (Microsoft SQL Server RCE): Allows an attacker to execute code in the context of the SQL Server service account. Hallmark detection: sqlservr.exe spawning cmd.exe, powershell.exe, or other child processes.
• •
  CVE-2021-23758 (Ajax.NET Professional deserialization): The .NET library deserializes attacker-controlled input, enabling RCE in any ASP.NET application embedding the vulnerable component. In IIS environments, watch w3wp.exe spawning command shells.
• •
  CVE-2022-0995 (Linux kernel watch_queue): An out-of-bounds write in the kernel's watch_queue event notification subsystem can allow a local user to gain privileged access.

The pattern across the batch is consistent: local privilege escalation chains on Linux, and RCE to host control chains on Windows application servers. The Linux flaws require local access, so they apply after an attacker already has a foothold, which makes behavioral detection on process lineage more durable than signature-based detection on the exploits themselves.

Detection rules

The following detection patterns target observable behaviors from this KEV batch. Each targets process lineage rather than exploit signatures, because the same parent-child process relationships appear regardless of which specific CVE the attacker used to gain initial access.

NetScaler post-exploitation shell spawning

Detects the NetScaler packet processing engine (nsppe) or the management web server (httpd, or nshttpd on BLX) spawning shells or interpreters. This covers post-exploitation behavior from earlier NetScaler campaigns. Citrix describes CVE-2026-8452 as leading to unpredictable behavior and denial of service, but the watchTowr research shows code execution is possible, so the rule applies to this CVE as well as to general appliance compromise.

Sigma rule:

title: NetScaler Post-Exploitation Shell Spawning
id: 4e7c2a91-6b3d-4f18-9c05-2a8d7e1b4f60
status: experimental
description: Detects NetScaler packet engine (nsppe) or management web server (httpd, nshttpd) spawning shells
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: ImmunitySec
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nsppe'
      - '/httpd'
      - '/nshttpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Rare scripted appliance maintenance executed under service context
level: critical

SQL Server service process spawning command shell

Detects sqlservr.exe spawning command shells or script interpreters, a hallmark of SQL Server exploitation including CVE-2019-1068 and xp_cmdshell abuse chains.

title: SQL Server Service Process Spawning Command Shell
id: 8b1f4d26-3c7a-4e59-b2d8-5f9a1c6e3d72
status: experimental
description: Detects sqlservr.exe spawning command shells
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: ImmunitySec
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate maintenance jobs invoking xp_cmdshell (should be disabled by policy)
level: high

IIS worker process spawning shells

Detects the IIS worker process spawning command shells or interpreters, consistent with exploitation of .NET deserialization flaws such as CVE-2021-23758 in Ajax.NET Professional.

title: IIS Worker Process Spawning Shells - Deserialization Exploitation
id: 2c9a6e84-1f5b-4d37-a8c2-7e4b9d1f5a38
status: experimental
description: Detects w3wp.exe spawning command shells, consistent with .NET deserialization
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: ImmunitySec
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy applications that shell out for batch processing
level: high

Linux identity file integrity monitoring

For CVE-2015-3246 (libuser race condition), file integrity monitoring on /etc/passwd, /etc/shadow, and /etc/group records every write and attribute change to the identity files. Deploy via auditd:

auditctl -w /etc/passwd -p wa -k identity_files
auditctl -w /etc/shadow -p wa -k identity_files
auditctl -w /etc/group -p wa -k identity_files

Alert on writes from any process other than authorized account management tooling (useradd, usermod, passwd, chfn, chsh).

Operationalizing the KEV catalog

Under BOD 26-04, the remediation timeline for federal agencies depends on whether the asset is publicly exposed, whether the CVE is in the KEV catalog, whether exploitation can be automated, and whether the impact is partial or total control. When a vulnerability is publicly exposed, automatable, and has total technical impact, the KEV due date reflects a three-day deadline. Entries CISA flags for forensic triage (in this batch, CVE-2019-1068 and CVE-2022-0995) also require the agency to assess whether the asset has been compromised. Each KEV entry carries its own due date: in this batch, CVE-2026-8452, CVE-2019-1068, and CVE-2022-0995 were due August 29, 2026, and the other three September 9, 2026.

Private sector organizations should hold themselves to the same clock. The KEV catalog is an input to vulnerability management prioritization, not a compliance checkbox. The August 2026 batch demonstrates why: flaws from 2015, 2019, 2021, and 2022 are all active attack paths in 2026.

For teams building detection engineering programs, the KEV catalog provides a continuous stream of hypotheses. Each KEV entry answers the first question in the detection lifecycle: what adversary behavior should we detect? The process lineage detections above work because they target the behavior that follows exploitation (shell execution, credential access, privilege escalation) rather than the exploit itself, which means they catch both the specific CVE and future variants that produce the same outcome.