TL;DR: On August 26, CISA dropped six vulnerabilities into its Known Exploited Vulnerabilities catalog in a single day. That is not a routine housekeeping update. Every entry on that list carries proof of real attacks. One of the six is being punched right now.
What Happened?
CISA added six flaws to the KEV catalog, all backed by evidence of active exploitation. The headline entry is CVE-2026-8452, a memory overflow bug in Citrix NetScaler ADC and NetScaler Gateway with a CVSS score of 8.8. Citrix disclosed it on June 30 and shipped a patch the same day. Attackers are hitting it anyway.
The flaw shows up when an appliance runs as a Gateway covering SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server. Citrix first called it a denial of service issue. Researchers later published a proof of concept showing it can lead to unauthenticated remote code execution, which is a far bigger problem.
The other five are older bugs still finding victims. There are two Red Hat flaws from 2015, a Microsoft SQL Server remote code execution bug from 2019, an Ajax.NET deserialization flaw from 2021, and a Linux kernel out of bounds write from 2022.
Four of those trace back to a report from Cisco Talos on a Chinese cybercrime group tracked as UAT-10147, which has been targeting Windows and Linux web servers across education, media, technology, and gaming. There is no public detail yet on how the SQL Server bug is being used.
What’s the Impact?
Threat intel firms watched the NetScaler attacks unfold. Telemetry showed 36 exploitation attempts over 12 days from 12 unique IP addresses spread across ten countries. Attackers dropped PHP web shells, then ran quick discovery commands to map what they had broken into.
Here is the sharp part. The NetScaler patch has existed since June 30. The SQL Server fix has existed for seven years. The Red Hat bugs are a decade old. Every one of these had an available update, and every one is still getting exploited. A patch that never gets applied protects no one.
Federal agencies now have hard deadlines. The SQL Server and NetScaler flaws must be fixed by August 29. The rest are due September 9. Those dates are for government, but attackers do not check whether a target is a federal agency before they fire.
CVE-2026-8452 Indicators of Compromise HIGH · CVSS 8.8
Citrix NetScaler ADC and NetScaler Gateway. Observed exploitation reported by threat intel researchers. Network indicators are defanged.
Web shell artifacts
| Type | Indicator | Notes |
|---|---|---|
| Filename | x.php | PHP web shell dropped after exploitation |
| Filename | z.php | Second observed web shell name |
| Web path | /var/vpn/theme/ | Directory where the shell is written on the appliance |
| Shell content | <?php echo(system($_GET[0])); ?> | Pattern shown in public proof-of-concept research |
Behavioral indicators
| Stage | What to look for |
|---|---|
| Discovery commands | Execution of id and echo shortly after web requests to a PHP file in the VPN theme path |
| Root check | Requests invoking a SUID /bin/sh to run commands, e.g. reading account or password files |
| Process crash pattern | Repeated nsppe crash and respawn events, consistent with the memory overflow being triggered |
| Unexpected files | New or unknown .php files in NetScaler web directories that do not match your baseline |
| Config exposure | Appliance running as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server on an unpatched build |
Telemetry context
| Metric | Reported value |
|---|---|
| Exploitation attempts | 36 over a 12-day window |
| Unique attacker IPs | 12 |
| Source regions | Switzerland, Germany, Hong Kong, Japan, Netherlands, Russia, Singapore, Turkey, United States, Vietnam |
Fixed versions
| Branch | Patched release |
|---|---|
| 14.1 | 14.1-72.61 and later |
| 13.1 | 13.1-63.18 and later |
| 13.1-FIPS / NDcPP | 13.1-37.272 and later |
How to Avoid This
Start with the two urgent ones. Patch NetScaler ADC and Gateway to a fixed release, and patch SQL Server if you still run an unpatched build. Then work the rest.
A few moves that matter here:
- Cross-check every asset you own against the CISA KEV catalog, not just this week’s additions
- Prioritize edge appliances and internet-facing services, since NetScaler sits right at the perimeter
- Hunt for unexpected PHP files in NetScaler web directories and odd shell activity after the crash-and-respawn pattern
- Confirm patches actually landed, because a reboot can wipe an attacker’s foothold but a missed update leaves the door open