CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

The investigation first tested whether the headline represented one campaign or a broad KEV update and found three evidence strands: a CISA-confirmed six-CVE event, a separately observed NetScaler exploitation wave, and a Talos-documented UAT-10147 campaign using four of the older flaws. Vendor and government records confirmed the affected components and mitigations, while original research established the actor, malware and victim scope. The evidence supports high confidence in exploitation of all six CVEs, but not a single shared actor or exploit chain.

1. Did CISA actually add all six stated CVEs because of exploitation evidence?
   Opened and assessed the supplied article as untrusted secondary reporting.
   thehackernews.com ↗

   The article named all six CVEs and connected four to UAT-10147, while identifying separate NetScaler observations and an unexplained SQL Server case.

   why This framed the event as a broad KEV update rather than evidence of one unified campaign and identified the primary sources requiring verification.

2. Does the authoritative record confirm exploitation and the exact CVE set?
   Read CISA's 26 August 2026 alert.
   cisa.gov ↗

   CISA listed all six CVEs and stated that their addition was based on evidence of active exploitation.

   why This is the strongest available confirmation of in-the-wild exploitation, although it does not disclose case-level evidence.

3. Is there independent evidence and a timeline for CVE-2026-8452 exploitation?
   Reviewed the dedicated exploitation record.
   previdian.com ↗

   The record reports sensor-observed attempts beginning 17 August 2026, continuing through 27 August, and notes public scanner or proof-of-concept coverage.

   why This independently supports the NetScaler exploitation timeline while distinguishing observed attempts from a quantified count of successful compromises.

4. Which NetScaler configurations and releases are affected, and what fixes exist?
   Opened the Citrix security bulletin and examined its affected-version, precondition and remediation sections.
   support.citrix.com ↗

   CVE-2026-8452 affects appliances configured as a Gateway or AAA virtual server; Citrix supplied fixed 14.1, 13.1, FIPS and NDcPP builds.

   why The vendor record narrows exposure to specific configurations and provides actionable remediation rather than assuming every NetScaler appliance is exploitable.

5. Which of the older vulnerabilities were actually used by UAT-10147, and against whom?
   Read Cisco Talos' original campaign report.
   blog.talosintelligence.com ↗

   Talos observed CVE-2022-0995, CVE-2015-5287 and CVE-2015-3246 for Linux privilege escalation and CVE-2021-23758 for remote code execution, targeting exposed web servers across several sectors and countries.

   why This supplies campaign-level exploitation evidence, victimology and actor attribution for four CVEs without extending that attribution to NetScaler or SQL Server activity.

6. What malware and post-compromise capabilities followed exploitation?
   Reviewed Talos' companion malware analysis.
   blog.talosintelligence.com ↗

   Talos documented SPECTRE, a Linux rootkit, BadIIS-related activity and defence-evasion capabilities across Windows and Linux.

   why This establishes the operational impact beyond initial exploitation and supplies concrete behaviours defenders can hunt.

7. What is technically established about the unexplained SQL Server entry?
   Checked the NVD record for CVE-2019-1068.
   nvd.nist.gov ↗

   The flaw is remote code execution caused by incorrect processing of internal functions, requires network access and low privileges under the published vector, and was added to KEV on 26 August 2026.

   why The record verifies the affected security boundary and severity, but does not resolve the actor, exploitation method or victims.

8. Is public exploit material available for any of the listed local privilege-escalation flaws?
   Opened the original oss-security disclosure for CVE-2015-5287.

   The disclosure describes the ABRT symlink weaknesses and provides attached local-root exploit demonstrations for affected Red Hat-family systems.

   why This confirms public exploit availability for CVE-2015-5287 while avoiding the unsupported conclusion that public code alone proves current exploitation.