CISA Adds Six Actively Exploited Vulnerabilities — Linux and SQL Server Are in the List
- The Mess: CISA has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are exploiting them in the wild. The batch includes vulnerabilities affecting Citrix NetScaler, Linux/Red Hat, Microsoft SQL Server and other enterprise software.
This is the kind of update that deserves attention even when some of the individual CVEs aren’t brand new.
Why?
Because KEV changes the risk calculation.
A vulnerability can sit in a database for months with a high CVSS score and remain theoretical.
Once CISA confirms exploitation, the question changes from:
“Could somebody exploit this?”
to:
“Someone is already doing it.”
And that’s exactly what happened with this latest batch.
The NetScaler one is particularly nasty
The most immediately interesting vulnerability is CVE-2026-8452, affecting Citrix NetScaler ADC and Gateway.
We’ve already covered this one separately on Bugstoday, so we’re not going to duplicate it here.
CISA’s addition confirms what researchers were already seeing: the flaw is being exploited in the wild, and watchTowr demonstrated that exploitation can lead to remote code execution as root, despite Citrix initially describing the issue primarily as a denial-of-service vulnerability.
That’s a perfect example of why threat intelligence matters.
The original assessment of a vulnerability can change dramatically once researchers get their hands on it.
Linux is also in today’s KEV update
One of the six newly catalogued vulnerabilities affects Linux/Red Hat infrastructure.
That’s particularly relevant because Linux vulnerabilities often disappear into the background behind the enormous volume of Windows CVEs.
But Linux servers are everywhere:
- cloud infrastructure;
- web servers;
- containers;
- virtualization;
- enterprise applications;
- networking appliances;
- development environments.
And when a Linux vulnerability reaches KEV, it deserves much more attention than another theoretical kernel bug.
CISA’s designation means there is evidence of real-world exploitation, not simply a researcher demonstrating that exploitation might be possible.
Microsoft SQL Server is another interesting target
The latest batch also includes a Microsoft SQL Server vulnerability.
That’s significant because database servers are particularly valuable targets.
An attacker who gets into a database doesn’t necessarily need to compromise the entire operating system immediately.
They may already have access to:
customer data → credentials → application secrets → internal network information.
And databases are often connected to practically everything.
Web applications talk to them.
Backup systems access them.
Applications authenticate against them.
Administrators manage them remotely.
One vulnerable SQL Server can therefore become a useful pivot point.
The bigger story isn’t the six CVEs
Here’s the part I think is more important.
CISA’s KEV catalog is increasingly becoming a real-world exploitation signal rather than simply another vulnerability list.
The latest addition brings the number of newly confirmed exploited flaws this week into a significant cluster, with CISA explicitly saying the additions are based on evidence of active exploitation.
That means organizations should be prioritizing vulnerabilities based on attack reality, not simply CVSS.
A CVSS 9.8 vulnerability with no known exploitation might be less urgent today than a CVSS 7 vulnerability that attackers are actively weaponizing.
That’s not an argument to ignore the 9.8.
It’s an argument to understand what is happening right now.
The Fix
The obvious answer is:
Check your infrastructure against the latest CISA KEV catalog and patch the affected products immediately.
But there’s another step.
If you operate any of the affected systems and they were exposed to the Internet, don’t assume that applying the patch means the incident is over.
Check logs.
Look for exploitation attempts.
Look for unusual authentication.
Look for unexpected processes.
Look for outbound connections.
Look for changes to configuration.
And for systems that can be compromised without authentication, investigate before and after the patch window.
Because the attacker may already have been there.
Bugstoday Opinion
This is why I like the KEV catalog more than giant lists of thousands of CVEs.
Six vulnerabilities.
That’s manageable.
And we know something important about them:
attackers are actually using them.
The challenge is filtering out the CVEs we’ve already covered and finding the genuinely new signal.
For Bugstoday, that’s exactly what we’ll keep doing.
We’re not going to publish:
“CISA added six CVEs!”
just for the sake of another article.
We’ll take the interesting individual vulnerabilities and turn them into proper stories.
And we’ve already covered CVE-2026-8452 / NetScaler, so there’s no reason to recycle it.
Bugstoday verdict: CVSS tells you how bad a vulnerability could be. KEV tells you that somebody is already trying. When the two meet, patching stops being a recommendation and becomes a priority.
