CISA's Newest KEV Batch Has an 11-Year-Old Bug in It — But Not All Six Are the Same Story
Cisco Talos tied four decade-plus-old Linux and .NET bugs to an AI-tooling Chinese crew. The other two CVEs added to KEV in the same CISA alert — a Citrix NetScaler RCE and a 2019 SQL Server flaw — have nothing to do with that campaign.
On August 26, 2026, CISA added six CVEs to its Known Exploited Vulnerabilities catalog in a single alert. Read as one press release, it looks like one story: a wave of active exploitation, split across two remediation deadlines. It isn't one story. It's three, and they don't share an attacker.
The batch, sorted correctly
| CVE | Product | CVSS | Published | Who's exploiting it | FCEB deadline |
|---|---|---|---|---|---|
| CVE-2015-3246 | Red Hat libuser | 5.1 | 2015 | UAT-10147 (Cisco Talos) | Sep 9, 2026 |
| CVE-2015-5287 | Red Hat ABRT | 7.8 | 2015 | UAT-10147 (Cisco Talos) | Sep 9, 2026 |
| CVE-2022-0995 | Linux kernel (watch_queue) | 7.8 | 2022 | UAT-10147 (Cisco Talos) | Sep 9, 2026 |
| CVE-2021-23758 | Ajax.NET Professional | 8.1 | 2021 | UAT-10147 (Cisco Talos) | Sep 9, 2026 |
| CVE-2019-1068 | Microsoft SQL Server | 8.8 | 2019 | Unattributed — no public detail | Aug 29, 2026 |
| CVE-2026-8452 | Citrix NetScaler ADC/Gateway | 9.8 | 2026 | Unattributed — opportunistic scanning | Aug 29, 2026 |
Story one: an AI-tooling crew farming bugs from 2015–2022
Cisco Talos published its report on UAT-10147 on August 20, 2026 — a Chinese-speaking group Talos assesses, with moderate-to-high confidence, is financially motivated (SEO fraud and data theft) and part of an emerging class of actors using agentic AI to scale offensive operations against internet-exposed Windows and Linux web servers.
Scores as of 2026-09-03live record →
- DeepAudit for automated source-code vulnerability scanning, found installed on the group's own management server
- PentestGPT to dynamically scan target web servers and run proof-of-concept exploits
- AI-generated documentation and four companion Python scripts (check_paths.py, deploy_implant.py, deploy_shell.py, exfil.py) built around the ysoserial deserialization framework, including a full ASP.NET ViewState RCE guide
- Known malware/tools in the operation: Metasploit, Meterpreter, QuasarRAT disguised as svchosts.exe, EfsPotato, Gh0stCringe, NoodleRAT, and a custom implant Talos calls SPECTRE
Talos found a target list of roughly 170,000 URLs on the group's command-and-control open directory, split into 17 files of about 10,000 each, aimed at government, education, media, technology and gaming targets. Compromised servers were located in Brazil, Bolivia, China, Canada and Vietnam. None of the four CVEs behind this campaign are new — the newest, CVE-2022-0995, is three and a half years old; the oldest two are from 2015.
Stories two and three: NetScaler's severity flip, and a 2019 bug nobody's explained
CVE-2026-8452 is the batch's other critical, and its history is its own story. Citrix patched it on June 30, 2026, in bulletin CTX696604, describing it narrowly as a memory overflow that "may lead to unpredictable behavior or denial of service" on NetScaler ADC/Gateway appliances configured as a Gateway VPN or AAA virtual server — and stated it had observed no exploitation at the time.
What Citrix said on patch day vs. what researchers proved six weeks later
- "Memory overflow" leading to "unpredictable behavior or denial of service"
- No exploitation observed
- Own CVSS 4.0 vector stopped short of code execution
- Binary-diffed patched vs. unpatched nsppe engine, found undocumented size checks
- Root cause: heap buffer overflow in SAML SignedInfo canonicalization, via the PrefixList attribute of InclusiveNamespaces
- Demonstrated a write-what-where primitive escalating to root-level RCE
- NVD independently scored it CVSS 3.1 9.8 — critical, not DoS
CVE-2026-8452: from patch-day DoS label to root shell
- Attacker sends crafted SAML SignedInfo (PrefixList / InclusiveNamespaces)
- nsppe packet engine parses it — heap buffer overflow (CWE-119)
- Write-what-where primitive established
- pitboss crash-monitor process bypassed
- Root-level remote code execution, unauthenticated
- Webshells x.php / z.php dropped; id, echo run for recon
Threat-intel outfits Defused Cyber and Previdian (formerly KEVIntel) picked up the resulting exploitation independently — Previdian logged 36 exploitation attempts over a 12-day window from 12 unique IPs spread across ten countries (Switzerland, Germany, Hong Kong, Japan, the Netherlands, Russia, Singapore, Türkiye, the U.S., Vietnam). That geographic spread reads as opportunistic "pray and spray" scanning, not a single attributable campaign — and as of writing, no group has claimed it.
The pattern that does connect them
| Label | Value |
|---|---|
| CVE-2015-3246 | 11 |
| CVE-2015-5287 | 11 |
| CVE-2019-1068 | 7 |
| CVE-2021-23758 | 5 |
| CVE-2022-0995 | 4 |
| CVE-2026-8452 | 0 |
Attribution aside, the batch does share one real thing: five of the six patches have existed for years, in some cases over a decade, and someone found unpatched machines to exploit them on anyway. Our own database still lists CVE-2026-8452 as has_exploit: false and puts its EPSS score at just 1.6% — a live illustration of the gap between what a scoring model predicts and what a CISA telemetry-backed KEV addition confirms already happened. CVSS tells you the ceiling of the damage; EPSS tells you a probability; only KEV tells you it's already been used.
What to actually do with this alert
- Patch by deadline group, not by narrative: CVE-2019-1068 and CVE-2026-8452 are due August 29; the four UAT-10147 CVEs are due September 9 under BOD 26-04.
- If you run NetScaler ADC/Gateway as a Gateway VPN or AAA virtual server, treat CVE-2026-8452 as unauthenticated root RCE, not the DoS Citrix's June bulletin described — versions 14.1-72.61 (FIPS), 13.1-63.18 and 13.1-37.272 carry the fix.
- Don't assume decade-old Linux privesc bugs are irrelevant because they're old — UAT-10147 is proof they're still a working toolkit against unpatched, internet-facing servers.
- Don't wait for attribution to patch. Two of these six CVEs have no named actor at all and are exploited anyway.
KEV and scoring data current as of 2026-09-03