CISA KEV Alert: Six Actively Exploited Flaws in Microsoft, Linux, Red Hat and Citrix Products — Detection and Remediation Guide

On August 26, CISA added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, spanning products from Microsoft, the Linux kernel ecosystem, Red Hat, and Citrix. Inclusion in the KEV is not a theoretical exercise — CISA only adds vulnerabilities when there is reliable evidence of active exploitation in the wild. That means threat actors have working exploit paths against these products right now, and any unpatched instance in your environment should be treated as potentially compromised, not merely vulnerable.

For federal civilian agencies, KEV listing triggers a binding remediation deadline under BOD 22-01 (typically three weeks from the listing date). For everyone else, the KEV deadline should be treated as your internal SLA. In my experience leading IR engagements, the gap between KEV publication and mass exploitation by ransomware affiliates and initial access brokers has collapsed to days — sometimes hours. If your asset inventory cannot tell you within the hour whether you run affected builds of Citrix NetScaler, Red Hat Enterprise Linux, or the impacted Microsoft components, that gap is your real exposure.

This post breaks down the defensive implications of this KEV batch, provides hunting logic for the observable behaviors these exploitation campaigns produce, and gives you verification scripts to confirm remediation actually landed.

Technical Analysis

What We Know

The August 26 KEV additions cover six vulnerabilities across four major technology stacks:

• Microsoft — a Windows ecosystem component with confirmed in-the-wild exploitation
• Linux kernel — a flaw affecting the upstream kernel and downstream distributions
• Red Hat — an affected enterprise product in the RHEL/OpenShift family
• Citrix — a vulnerability in Citrix's product line, historically concentrated in NetScaler ADC/Gateway appliances

The specific CVE identifiers for this batch are published in CISA's KEV catalog itself. Before building detection content, pull the authoritative list directly from CISA (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) and map each CVE to your asset inventory. Do not rely on secondhand summaries for CVE-to-product mapping — mis-mapping a KEV entry to the wrong product version is one of the most common patch management failures I see during assessments.

Why This Product Mix Matters

This combination of vendors is significant. Each represents a distinct exploitation profile:

Citrix (NetScaler ADC/Gateway): NetScaler appliances sit at the network edge, terminate TLS, and broker authenticated access to internal applications. Historically exploited NetScaler flaws (pre-auth RCE, path traversal, session token theft) give attackers a beachhead that bypasses endpoint controls entirely — appliances run no EDR, generate limited telemetry, and are frequently excluded from vuln scans. Post-exploitation behavior typically includes webshell drops into the NetScaler web directories, anomalous processes spawned by the appliance's web services, and outbound connections from the appliance to attacker infrastructure.

Linux kernel: Kernel-level flaws are almost universally local privilege escalation or container escape primitives. Attackers chain them after initial access — web shell on a public-facing app, then kernel LPE to root, then credential harvesting and lateral movement. Detection opportunities center on anomalous SUID binary creation, unexpected kernel module loads, and privilege transitions in audit logs.

Red Hat: Enterprise-facing flaws here tend to affect middleware, identity components, or container infrastructure. Exploitation of Red Hat products often targets the management plane — Satellite, OpenShift, or Identity Management — which makes compromise disproportionately impactful.

Microsoft: Actively exploited Microsoft flaws in KEV batches are typically privilege escalation or code execution primitives chained with phishing or exposed services for initial access.

Exploitation Status

All six vulnerabilities carry CISA's highest confidence signal: confirmed active exploitation. This is not a "patch when convenient" situation. Under BOD 22-01, federal agencies face a binding remediation deadline (approximately September 16, three weeks post-listing). Private-sector organizations should adopt the same deadline internally — ransomware operators scrape the KEV within hours of publication.

Detection & Response

The detections below target the post-exploitation behaviors most consistently observed across KEV-listed flaws in these product classes — edge appliance webshell drops, anomalous process spawning on appliances and Linux hosts, and privilege escalation indicators on Windows. Validate each rule in your environment before production deployment.

---
title: Suspicious Process Spawned by Citrix NetScaler Web Services
id: 8c1f4a92-3e7b-4d5a-9c21-6f8e2b4d7a35
status: experimental
description: Detects shell or scripting interpreters spawned by NetScaler web-facing processes, consistent with post-exploitation activity following edge appliance compromise.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'httpd'
      - 'nsppe'
      - 'nsconfd'
      - 'nshttpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate NetScaler maintenance scripts executed via GUI-integrated tools
  - Vendor support diagnostic collection
level: high
---
title: Webshell or Unexpected File Written to NetScaler Web Directories
id: 2d7e9b41-5a3c-4f68-b812-9e4c1a6d8f23
status: experimental
description: Detects creation of script or executable files in NetScaler web content directories, a hallmark of webshell deployment following appliance exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/netscaler/'
      - '/var/vpn/'
      - '/var/tmp/'
      - '/var/netscaler/gui/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.pl'
      - '.py'
      - '.jsp'
      - '.cgi'
      - '.sh'
  condition: selection_path and selection_ext
falsepositives:
  - Firmware upgrades and legitimate Citrix customization packages
level: high
---
title: Suspicious Child Process of Windows Service Hosting Processes
id: 4f2a8c63-7d1e-4b95-a634-8c5e3f7b2d19
status: experimental
description: Detects command interpreters or LOLBins spawned by Windows service host processes outside of normal management activity, consistent with privilege escalation or service exploitation follow-on activity.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.privilege_escalation
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\svchost.exe'
      - '\services.exe'
      - '\lsass.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
  filter_mgmt:
    CommandLine|contains:
      - 'sccm'
      - 'healthcheck'
  condition: selection_parent and selection_child and not filter_mgmt
falsepositives:
  - SCCM/Intune software deployment
  - Legitimate monitoring agent activity
level: medium

The KQL below hunts two surfaces in Microsoft Sentinel: (1) anomalous process execution ingested from Linux hosts and network appliances via Syslog/CEF, and (2) suspicious SYSTEM-level child processes on Windows endpoints via Defender telemetry. Run both during the 72-hour window after patching to check for pre-patch compromise.

let Lookback = 7d;
// Part 1: Hunt for shells or tooling spawned by web/appliance services on Linux and NetScaler hosts
Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName in~ ("sh", "bash", "python", "python3", "perl", "php", "curl", "wget", "nc", "ncat")
| where SyslogMessage has_any ("httpd", "nsppe", "nsconfd", "www-data", "nginx", "apache")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc
;
// Part 2: Windows — command interpreters spawned by service-hosting processes (potential post-exploitation privesc)
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("svchost.exe", "services.exe", "lsass.exe", "winlogon.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "wscript.exe", "cscript.exe")
| where not (ProcessCommandLine has_any ("sccm", "health", "intune", "omadm"))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

The Velociraptor artifact targets two forensic artifacts worth sweeping fleet-wide after a KEV batch like this: recently modified executable files in writable web content directories (webshell indicators) and recently created SUID binaries on Linux hosts (privilege escalation staging).

-- KEV follow-up hunt: webshell staging and SUID privilege-escalation artifacts
-- Looks for recently created/modified executable content in web-accessible and temp paths
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=[
  '/var/www/**/*.php',
  '/var/tmp/*',
  '/tmp/*.sh',
  '/tmp/*.elf',
  '/netscaler/**/*.php',
  '/var/vpn/**/*.php'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

The script below verifies remediation posture: it checks a Citrix NetScaler appliance's build version via CLI, audits a Linux host for pending security updates and unexpected SUID binaries, and confirms whether the host was rebooted after kernel patching (a missed reboot leaves the old kernel running and the "patch" ineffective).

#!/bin/bash
# KEV remediation verification — Linux hosts and NetScaler appliances
# Run as root or via sudo. Verify against the fixed versions listed in each vendor advisory.

echo "=== [1] Kernel version (confirm patched kernel is RUNNING, not just installed) ==="
uname -r
echo "-> Compare against the fixed kernel version in your distro advisory (RHEL: access.redhat.com/errata; Ubuntu: ubuntu.com/security)"

echo "=== [2] Pending security updates ==="
if command -v dnf &>/dev/null; then
  dnf updateinfo list security --available 2>/dev/null | head -50
elif command -v apt &>/dev/null; then
  apt list --upgradable 2>/dev/null | grep -i secur
fi

echo "=== [3] Reboot check — was the host restarted after kernel patching? ==="
if [ -f /var/run/reboot-required ]; then
  echo "WARNING: reboot required to apply kernel patches"; cat /var/run/reboot-required.pkgs 2>/dev/null
else
  uptime
fi

echo "=== [4] Recently created SUID binaries (potential privesc staging) ==="
find / -xdev -perm -4000 -type f -mtime -14 2>/dev/null

echo "=== [5] Unexpected listeners (webshell/backdoor reverse ports) ==="
ss -tulnp 2>/dev/null | grep -Ev 'sshd|systemd|named|ntpd' | head -30

echo "=== [6] NetScaler check (run on appliance via ssh nsroot@<NSIP>) ==="
echo "  > show ns version"
echo "  > Compare build against the fixed build in the Citrix security bulletin at support.citrix.com"
echo "  > Also run: shell ls -la /var/vpn /netscaler/ns_gui  (look for recent unexpected .php/.pl files)"

Remediation

Immediate actions (within 24 hours):

1. Pull the authoritative CVE list. Retrieve the six entries directly from CISA's KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) and the linked vendor advisories for Microsoft (msrc.microsoft.com), Red Hat (access.redhat.com/security), Citrix (support.citrix.com), and your Linux distribution's security tracker. Map every CVE to specific affected product versions — do not guess.

2. Patch edge-facing assets first. Citrix NetScaler and any internet-exposed Microsoft or Red Hat services take priority. Edge devices are the initial access vector; internal privilege escalation flaws are chained later.

3. Treat "patched" as "verify not compromised." If an affected system was internet-reachable and unpatched after exploitation was public, patching alone does not remove webshells or persistence. Run the detection content above against at minimum 14 days of telemetry and the forensic sweep in the VQL artifact before closing the ticket.

4. Reboot after kernel patches. The single most common Linux remediation failure: packages updated, running kernel unchanged. Confirm with uname -r.

Within the CISA deadline (~3 weeks):

• Complete remediation across the full asset inventory and produce exception documentation for anything you cannot patch (with compensating controls: network isolation, virtual patching via WAF rules, enhanced monitoring).
• For NetScaler appliances that cannot be immediately patched: restrict management interface access to a dedicated admin VLAN, disable the management GUI from untrusted networks, and apply any vendor-published mitigations.
• Confirm your vulnerability scanner's plugin coverage actually detects these six CVEs — authenticated scans only; unauthenticated scans routinely miss NetScaler build-level detail.

Standing improvements:

• Subscribe to CISA KEV feeds (JSON/CSV at cisa.gov) and wire KEV additions into your ticketing system as auto-generated critical-severity work items with the CISA due date as SLA.
• Deploy telemetry collection for edge appliances (NetScaler supports syslog export) into your SIEM — appliances without logs are blind spots attackers actively prefer.
• Add a "KEV delta" metric to your vulnerability management reporting: time from KEV publication to verified remediation.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub