CISA KEV August 2026: Citrix NetScaler CVE-2026-8452 and Five Legacy Flaws Now Actively Exploited

The August 26, 2026 KEV batch

On August 26, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog based on confirmed evidence of active exploitation. The headline entry is CVE-2026-8452, a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Alongside it sit five older flaws across Red Hat Linux, Microsoft SQL Server, Ajax.NET Professional, and the Linux kernel, all confirmed as present-day attack paths rather than historical trivia.

The inclusion of legacy CVEs is instructive. Threat actors are systematically sweeping for unpatched assets years after disclosure, and any organization that deprioritized these fixes because of their age is now exposed to live exploitation.

CVE-2026-8452: Citrix NetScaler ADC and Gateway

Perimeter appliances sit in front of sensitive authentication and application traffic, have historically limited EDR visibility, and are favored by both financially motivated actors and state-sponsored intrusion sets. Post-exploitation behavior against NetScaler is well documented from prior campaigns: attackers drop web shells under the gateway and VPN content directories, execute commands via the appliance shell, and harvest credentials and session tokens for downstream access.

On a compromised appliance, the NetScaler packet engine (nsppe) or internal HTTP management service (nshttpd) spawning shells and interpreters is behavior that is never legitimate in production.

The legacy five: old bugs, live exploitation

These are not new discoveries. They are being re-exploited today against estates that never finished patching.

• •
  CVE-2015-3246 (Red Hat libuser race condition): A race in the libuser library allows a local unprivileged user to corrupt /etc/passwd and gain root. Detection: unexpected modification of /etc/passwd by non-administrative processes.
• •
  CVE-2015-5287 (Red Hat ABRT privilege escalation): The Automatic Bug Reporting Tool could be abused by local users to execute code with elevated privileges via a symlink attack on a file with a predictable name in coredump processing.
• •
  CVE-2019-1068 (Microsoft SQL Server RCE): Allows an attacker to execute code in the context of the SQL Server service account. Hallmark detection: sqlservr.exe spawning cmd.exe, powershell.exe, or other child processes.
• •
  CVE-2021-23758 (Ajax.NET Professional deserialization): The .NET library deserializes attacker-controlled input, enabling RCE in any ASP.NET application embedding the vulnerable component. In IIS environments, watch w3wp.exe spawning command shells.
• •
  CVE-2022-0995 (Linux kernel watch_queue): An out-of-bounds write in the kernel's watch queue implementation enables local privilege escalation to root.

The pattern across the batch is consistent: local privilege escalation chains on Linux, and RCE to host control chains on Windows application servers. Attackers use these as the second stage after gaining an initial foothold, which makes behavioral detection on process lineage more durable than signature-based detection on the exploits themselves.

Detection rules

The following detection patterns target the highest-fidelity observable behaviors from this KEV batch. Each targets process lineage rather than exploit signatures, because the same parent-child process relationships appear regardless of which specific CVE the attacker used to gain initial access.

NetScaler post-exploitation shell spawning

Detects the NetScaler packet engine (nsppe) or internal HTTP management service (nshttpd) spawning shells or interpreters. This is consistent with post-exploitation activity against NetScaler memory corruption vulnerabilities including CVE-2026-8452.

Sigma rule:

title: NetScaler Post-Exploitation Shell Spawning
id: 4e7c2a91-6b3d-4f18-9c05-2a8d7e1b4f60
status: experimental
description: Detects NetScaler packet engine (nsppe) or HTTP management service (nshttpd) spawning shells
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: ImmunitySec
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nsppe'
      - '/nshttpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Rare scripted appliance maintenance executed under service context
level: critical

SQL Server service process spawning command shell

Detects sqlservr.exe spawning command shells or script interpreters, a hallmark of SQL Server exploitation including CVE-2019-1068 and xp_cmdshell abuse chains.

title: SQL Server Service Process Spawning Command Shell
id: 8b1f4d26-3c7a-4e59-b2d8-5f9a1c6e3d72
status: experimental
description: Detects sqlservr.exe spawning command shells
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: ImmunitySec
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate maintenance jobs invoking xp_cmdshell (should be disabled by policy)
level: high

IIS worker process spawning shells

Detects the IIS worker process spawning command shells or interpreters, consistent with exploitation of .NET deserialization flaws such as CVE-2021-23758 in Ajax.NET Professional.

title: IIS Worker Process Spawning Shells - Deserialization Exploitation
id: 2c9a6e84-1f5b-4d37-a8c2-7e4b9d1f5a38
status: experimental
description: Detects w3wp.exe spawning command shells, consistent with .NET deserialization
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: ImmunitySec
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy applications that shell out for batch processing
level: high

Linux identity file integrity monitoring

For CVE-2015-3246 (libuser race condition), file integrity monitoring on /etc/passwd, /etc/shadow, and /etc/group provides the most reliable detection with near-zero false positives. Deploy via auditd:

auditctl -w /etc/passwd -p wa -k identity_files
auditctl -w /etc/shadow -p wa -k identity_files
auditctl -w /etc/group -p wa -k identity_files

Alert on writes from any process other than authorized account management tooling (useradd, usermod, passwd, chfn, chsh).

Operationalizing the KEV catalog

Under BOD 26-04, federal agencies must identify whether a KEV-listed vulnerability meets the remediation threshold within three days and requires forensic triage to assess whether systems have been compromised. The KEV catalog entries flagged for forensic triage carry a shorter deadline than standard entries.

Private sector organizations should hold themselves to the same clock. The KEV catalog is an input to vulnerability management prioritization, not a compliance checkbox. The August 2026 batch demonstrates why: flaws from 2015, 2019, 2021, and 2022 are all active attack paths in 2026, because attackers sweep for unpatched assets regardless of when the patch shipped.

For teams building detection engineering programs, the KEV catalog provides a continuous stream of hypotheses. Each KEV entry answers the first question in the detection lifecycle: what adversary behavior should we detect? The process lineage detections above work because they target the behavior that follows exploitation (shell execution, credential access, privilege escalation) rather than the exploit itself, which means they catch both the specific CVE and future variants that produce the same outcome.