CISA added six vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerabilities affect Red Hat, Microsoft SQL Server, Ajax.NET Professional, Linux Kernel, and Citrix NetScaler products. BOD 26-04 requires FCEB agencies to prioritize remediation of these vulnerabilities on publicly exposed assets.
CVE-2026-8452
3 posts
CISA Adds Six Known Exploited Vulnerabilities to Catalog (CVE-2015-3246, CVE-2015-5287, CVE-2019-1068 +3 more) Cyber Centre Daily Advisory Digest — 2026-08-17 (7 advisories) The Canadian Centre for Cyber Security published 7 security advisories on 2026-08-17 covering vulnerabilities in Citrix NetScaler, Apple macOS, SAP, Microsoft Edge, IBM, Tenable, and Dell products. Four CVEs across Citrix (CVE-2026-8451, CVE-2026-8452), Apple (CVE-2026-65400), and SAP (CVE-2026-58231) are confirmed exploited in the wild. Immediate patching of NetScaler ADC/Gateway, macOS, and SAP NetWeaver/ABAP systems is recommended.
You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) A heap overflow vulnerability in Citrix NetScaler's SAML signature canonicalization allows unauthenticated remote code execution. The nsppe packet engine copies attacker-controlled PrefixList data from a SAML SignedInfo element into a fixed-size buffer without bounds checking, corrupting adjacent heap chunk metadata. This yields a write-what-where primitive that can overwrite the txpktcomplete_fptr function pointer for RIP control. The binary lacks ASLR, PIE, and has an executable heap, enabling direct shellcode execution. The exploit drops a PHP webshell and neutralizes signal handlers to prevent appliance reboots.
