CISA KEV Flash: 11 CVEs Added — Citrix NetScaler, Zimbra, Linux Kernel & Microsoft SQL Server Under Active Attack | Security Arsenal

Between August 20 and August 26, 2026, CISA added eleven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — its highest-confidence signal that exploitation is happening right now, not theoretically. This wave is unusually broad: it spans edge network appliances (Citrix NetScaler), collaboration platforms (Zimbra, TrueConf), web infrastructure (Oracle HTTP Server/WebLogic proxy), developer tooling (Gitea), legacy .NET deserialization (Ajax.NET Professional), the Microsoft SQL Server database tier, and a cluster of Linux local privilege escalation flaws that attackers chain after initial access.

Every CVE in this briefing carries a Binding Operational Directive (BOD 22-01) remediation deadline for Federal Civilian Executive Branch agencies. Private-sector organizations should treat these deadlines as their own — KEV-listed vulnerabilities are disproportionately represented in ransomware initial-access and post-compromise tooling.

Federal remediation due date for this batch: 2026-09-16.

Active Exploitation Intelligence

CVE-2026-8452 — Citrix NetScaler ADC / NetScaler Gateway (CRITICAL — PATCH FIRST)

Vulnerability class: Improper restriction of operations within the bounds of a memory buffer (CWE-119) — memory corruption.
Exploitation method: Unauthenticated remote code execution against internet-facing NetScaler ADC/Gateway appliances. This mirrors the exploitation pattern of CVE-2023-3519 and CVE-2025-6543 ("CitrixBleed 2"), which were weaponized within days for webshell deployment and session hijacking.
Threat actors: Historically, NetScaler memory-corruption flaws are exploited within 24–72 hours of public attention by both nation-state actors (APT5/UNC2630-style tradecraft) and ransomware affiliates (LockBit, Medusa, Akira ecosystems have all abused NetScaler). Attribution for this CVE is not yet public; ransomware linkage is unknown per CISA.
CVSS: Pending final scoring; treat as 9.8-equivalent given pre-auth RCE on an edge appliance.
PoC status: No confirmed public PoC at time of writing — exploitation is being observed from sophisticated actors only, which historically precedes mass exploitation.
CISA required action: Apply vendor mitigations per Citrix advisory or discontinue use if mitigations are unavailable. Due 2026-09-16.

CVE-2026-73570 — Synacor Zimbra Collaboration Suite (CRITICAL)

Vulnerability class: OS command injection (CWE-78).
Exploitation method: Unauthenticated remote attackers can send specially crafted requests to execute arbitrary OS commands on the Zimbra server. Zimbra hosts email — the crown jewels for espionage and BEC operations.
Threat actors: Zimbra flaws are a favorite of Chinese espionage clusters (e.g., the activity tracked around CVE-2024-45519 exploitation) and of initial-access brokers who sell Zimbra shells to ransomware crews. Mass scanning of Zimbra typically begins within hours of KEV listing.
CVSS: Pending; treat as 9.8-equivalent (unauthenticated RCE).
PoC status: Not publicly confirmed, but in-the-wild exploitation is confirmed by CISA.
CISA required action: Apply updates per vendor guidance. Due 2026-09-16.

CVE-2026-72529 & CVE-2026-72530 — TrueConf Server (HIGH — chained pair)

Vulnerability classes: Missing authentication for critical function (CWE-306) and code injection (CWE-94).
Exploitation method: A remote attacker with network access to port 4307/TCP can invoke critical server functions without authentication (72529) and inject code for remote execution (72530). The two are almost certainly being chained: auth bypass → code injection → full server compromise.
Threat actors: Video-conferencing infrastructure is high-value for Russian and Eastern European intrusion sets; TrueConf has significant deployment in government and enterprise environments across EMEA and Asia.
CVSS: Pending; treat as critical where port 4307 is reachable from untrusted networks.
PoC status: No public PoC confirmed.
CISA required action: Apply vendor updates; restrict network access to port 4307/TCP as an interim control. Due 2026-09-16.

CVE-2026-21962 — Oracle HTTP Server / Oracle WebLogic Server Proxy Plug-in (HIGH)

Vulnerability class: Improper access control (CWE-284).
Exploitation method: Unauthorized access to protected resources through the WebLogic proxy plug-in — in practice, this means bypassing the front-end access controls that shield WebLogic applications, enabling follow-on exploitation of the application tier.
Threat actors: WebLogic has a decade-long history of rapid weaponization (CVE-2020-14882, CVE-2023-21839) by cryptominers, IABs, and espionage actors. Expect scanning within days.
CVSS: Pending.
PoC status: No public PoC confirmed at time of writing.
CISA required action: Apply Oracle Critical Patch Update guidance. Due 2026-09-16.

CVE-2026-60004 — Gitea (HIGH — supply-chain/developer angle)

Vulnerability class: Code injection via malicious patch sent to the diffpatch functionality.
Exploitation method: An attacker with repository write access submits a crafted patch; when processed by the diff/patch handler, injected code executes on the Gitea server. This is an insider-threat and compromised-account vector — developer credentials are routinely harvested via infostealers and sold on underground markets.
Threat actors: Source-control compromise is a staple of supply-chain intrusion sets. Compromised Gitea instances give attackers CI/CD secrets, signing keys, and source code.
CVSS: Pending; post-auth constraint lowers raw severity, but blast radius in dev environments is severe.
PoC status: Not publicly confirmed.
CISA required action: Update Gitea per vendor advisory. Due 2026-09-16.

CVE-2019-1068 — Microsoft SQL Server (HIGH)

Vulnerability class: Remote code execution.
Exploitation method: An authenticated attacker (or one who has obtained SQL credentials) executes code in the context of the SQL Server service account — frequently a highly privileged account with domain visibility. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Threat actors: SQL Server RCE is a standard lateral-movement and data-staging primitive in ransomware playbooks; service-account context often yields rapid domain escalation.
PoC status: Public technical write-ups and exploit references have existed since 2019.
CISA required action: Apply Microsoft updates per the original security advisory. Due 2026-09-16.

CVE-2022-0995 — Linux Kernel (HIGH — LPE)

Vulnerability class: Out-of-bounds write in the watch_queue event notification subsystem (CWE-787).
Exploitation method: Local privilege escalation — an unprivileged local user triggers an OOB write to corrupt kernel memory, gaining root or crashing the host. CVSS 7.8.
Threat actors: Kernel LPEs are the second stage in nearly every Linux intrusion chain — after web-shell or container-escape initial access, attackers drop an LPE for root. Public exploit code exists for this flaw.
PoC status: Public PoC available since 2022.
CISA required action: Apply kernel updates; restrict execution of untrusted binaries. Due 2026-09-16.

CVE-2015-3246 — Red Hat libuser (MEDIUM — LPE)

Vulnerability class: Race condition (CWE-362) in libuser/userhelper.
Exploitation method: An authenticated local user wins a race to corrupt /etc/passwd, enabling denial of service or privilege escalation to root. CVSS ~7.0 range (local, high complexity).
PoC status: Public exploit code has existed since 2015 (Qualys disclosure).
Why it matters now: Eleven-year-old flaws appearing in KEV signals that attackers are inventorying unpatched legacy RHEL/CentOS estates — often forgotten servers, EOL systems, and inherited infrastructure.
CISA required action: Apply Red Hat updates. Due 2026-09-16.

CVE-2015-5287 — Red Hat ABRT (MEDIUM — LPE)

Vulnerability class: Privilege escalation in the Automatic Bug Reporting Tool.
Exploitation method: Local users with certain permissions escalate to root via ABRT's privileged crash-processing paths. Frequently chained with CVE-2015-3246 in the original disclosures — and likely being chained in current exploitation.
PoC status: Public since 2015.
CISA required action: Apply Red Hat updates. Due 2026-09-16.

CVE-2021-23758 — Ajax.NET Professional (AjaxPro) (HIGH — deserialization)

Vulnerability class: Deserialization of untrusted data (CWE-502).
Exploitation method: An attacker sends a crafted serialized payload to an AjaxPro endpoint, achieving remote code execution in the web-server process context. .NET deserialization flaws are reliably exploitable with gadget-chain tooling (ysoserial.net).
PoC status: Technical details public since 2021; gadget-chain exploitation is well understood.
Exposure note: AjaxPro is embedded in countless legacy ASP.NET line-of-business applications — many organizations don't know they ship it.
CISA required action: Apply vendor mitigations or discontinue the component. Due 2026-09-16.

Affected Organizations Assessment

Most exposed environments:

Organizations with internet-facing Citrix NetScaler ADC/Gateway — concentrated in finance, healthcare, government, and Fortune 1000 remote-access deployments. NetScaler's installed base means tens of thousands of internet-facing instances; patch-adoption lag on ADC appliances historically runs 30–60 days, and appliances are frequently excluded from standard patch pipelines.
Self-hosted Zimbra estates — extremely prevalent in education, government (especially non-US), telcos, and SMBs. Zimbra's free/open-source edition skews toward under-resourced IT teams; historical patch adoption for Zimbra flaws has been measured in weeks, giving attackers long windows.
Legacy RHEL/CentOS servers (the 2015-era CVEs) — EOL and near-EOL systems in manufacturing, energy, and government. These are the "forgotten fleet": OT-adjacent jump boxes, inherited application servers, and systems excluded from patching for "stability."
Windows/SQL Server estates — universal. CVE-2019-1068's presence in KEV indicates attackers are still finding unpatched SQL 2016/2017 instances, typically internal systems behind the perimeter that never received cumulative updates.
Legacy ASP.NET applications embedding AjaxPro — unknowable exposure scale without code inventory; assume presence in any .NET Framework-era LOB app.
Oracle HTTP Server/WebLogic proxy front ends — heavily concentrated in finance, telecom, and public sector running Oracle middleware stacks.
Self-hosted Gitea and TrueConf — smaller footprint, but developer-infrastructure compromise carries outsized supply-chain risk.

Sector exploitation velocity (historical): Edge appliances (NetScaler) see weaponization in hours-to-days across all sectors. Email/collaboration platforms (Zimbra) see espionage-driven exploitation first (government, education, telecom), followed by IAB mass-scanning. Kernel LPEs propagate via ransomware post-exploitation toolkits within weeks — every unpatched Linux host with any initial-access vector becomes rootable.

Detection Engineering

The Sigma rules below target observable exploitation behaviors for the highest-priority CVEs: NetScaler appliance compromise (unexpected processes/webshells), Zimbra command injection (postfix/amavis-spawned shells), and Linux LPE execution patterns (watch_queue abuse and /etc/passwd corruption).

YAML

---
title: NetScaler ADC/Gateway Suspicious Shell Spawn — CVE-2026-8452 Post-Exploitation
id: 9f3a1c2e-8b4d-4e1a-9c7f-2d5e6a8b0c11
status: experimental
description: Detects web server or system processes on Citrix NetScaler appliances spawning shells or writing to web-accessible directories, consistent with memory-corruption RCE post-exploitation and webshell deployment.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/nginx'
      - '/nsnetsvc'
      - '/nsppe'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/php'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate NetScaler administrative scripts (rare from httpd/nsppe parent)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1505.003
  - cve.2026.8452
---
title: Zimbra Mailbox Process Spawning Shell — CVE-2026-73570 Command Injection
id: 7b2e4d6f-1a3c-4e5b-8d9f-0a1b2c3d4e22
status: experimental
description: Detects Zimbra service accounts (zimbra, postfix, amavis) spawning interactive shells, interpreters, or downloaders — consistent with unauthenticated OS command injection against Zimbra Collaboration Suite.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: linux
detection:
  selection_user:
    User|contains:
      - 'zimbra'
      - 'postfix'
      - 'amavis'
  selection_image:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/perl'
      - '/base64'
      - '/nc'
      - '/ncat'
  filter_legit:
    CommandLine|contains:
      - '/opt/zimbra/bin/'
      - 'zmcontrol'
  condition: selection_user and selection_image and not filter_legit
falsepositives:
  - Zimbra backup or maintenance scripts executed under service accounts
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
  - cve.2026.73570
---
title: Linux LPE Indicators — CVE-2022-0995 watch_queue Abuse and /etc/passwd Race Corruption
id: 3c5a7b9d-2e4f-4a6b-9c1d-3e5f7a9b0c33
status: experimental
description: Detects local privilege escalation behavior consistent with Linux Kernel watch_queue OOB write exploitation (CVE-2022-0995) and libuser /etc/passwd race-condition corruption (CVE-2015-3246), including userhelper abuse and rapid passwd file modification by non-root processes.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: file_event
  product: linux
detection:
  selection_passwd:
    TargetFilename:
      - '/etc/passwd'
      - '/etc/shadow'
      - '/etc/passwd-'
      - '/etc/gshadow'
  filter_root:
    User|contains:
      - 'root'
      - 'system'
  filter_tools:
    Image|endswith:
      - '/useradd'
      - '/usermod'
      - '/passwd'
      - '/chpasswd'
      - '/userhelper'
      - '/vipw'
      - '/puppet'
      - '/ansible'
  condition: selection_passwd and not filter_root and not filter_tools
falsepositives:
  - Identity-management agents writing as service accounts
  - Container user-namespace remapping
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1078
  - cve.2022.0995
  - cve.2015.3246

Microsoft Sentinel (KQL) — KEV Wave Hunt

This query hunts across process, network, and file telemetry for indicators tied to this batch: Zimbra/NetScaler child-process anomalies, TrueConf port 4307 access, suspicious SQL Server code execution, and Gitea patch-processing abuse.

KQL — Microsoft Sentinel / Defender

let Lookback = 14d;
let SuspiciousServiceParents = dynamic(["httpd","nginx","nsnetsvc","nsppe","zmmailboxd","java","mysqld","sqlservr.exe","w3wp.exe","gitea","trueconf"]);
let SuspiciousChildren = dynamic(["sh","bash","dash","python","perl","php","curl","wget","nc","ncat","base64","cmd.exe","powershell.exe","certutil.exe","bitsadmin.exe"]);
union
// Web/app-tier processes spawning shells or downloaders (NetScaler, Zimbra, AjaxPro w3wp, Gitea, TrueConf)
(DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName has_any (SuspiciousServiceParents)
| where FileName has_any (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Hunt="Service process spawned shell/downloader"),
// SQL Server spawning OS commands (CVE-2019-1068 style xp_cmdshell / post-RCE behavior)
(DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName has_any (dynamic(["cmd.exe","powershell.exe","whoami.exe","net.exe","nltest.exe","rundll32.exe"]))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Hunt="SQL Server spawned OS command (possible CVE-2019-1068)"),
// Inbound connections to TrueConf port 4307 from non-internal sources (CVE-2026-72529/72530)
(DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where LocalPort == 4307 and ActionType == "InboundConnectionAccepted"
| extend RemoteIsInternal = ipv4_is_private(RemoteIP)
| where RemoteIsInternal == false
| summarize Connections=count(), RemoteIPs=make_set(RemoteIP) by DeviceName, LocalIP, bin(TimeGenerated, 1h)
| project TimeGenerated, DeviceName, LocalIP, Connections, RemoteIPs, Hunt="External inbound to TrueConf 4307/TCP"),
// /etc/passwd or shadow modification by non-standard processes (CVE-2015-3246 race condition)
(DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has_any ("/etc/passwd","/etc/shadow","/etc/gshadow")
| where ActionType in ("FileModified","FileCreated","FileRenamed")
| where not(InitiatingProcessFileName has_any (dynamic(["useradd","usermod","passwd","chpasswd","userhelper","vipw","sssd","puppet","ansible"])))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, ActionType, Hunt="Account DB modified by unusual process (CVE-2015-3246)")
| order by TimeGenerated desc

Inventory & Patch Verification Script (PowerShell + Bash hybrid approach)

Use this PowerShell script to inventory and validate remediation on Windows assets (SQL Server, AjaxPro exposure), then the Bash one-liners for Linux estate checks. Run with appropriate privileges; review output before any remediation action.

PowerShell

<#
.SYNOPSIS
  Security Arsenal - KEV Wave 2026-08-26 Inventory & Patch Verification
.DESCRIPTION
  1) Identifies SQL Server instances and checks build against CVE-2019-1068 fix baselines
  2) Scans ASP.NET app directories for vulnerable AjaxPro (Ajax.NET Professional) assemblies
  3) Reports TrueConf/Gitea service presence if installed on Windows
  Outputs CSV for SOC triage. Read-only: no changes are made.
.NOTES
  Run elevated. Test in staging first. Remediation per vendor advisories only.
#>

$ErrorActionPreference = 'SilentlyContinue'
$ReportPath = "$env:TEMP\KEV_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$Results = @()

# ---- 1) SQL Server build check (CVE-2019-1068) ----
# Fix baseline: SQL 2016 SP2 CU7 (13.0.5337.0)+ / SQL 2017 CU15 (14.0.3162.1)+ per MS advisory
$SqlInstances = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL' -ErrorAction SilentlyContinue
if ($SqlInstances) {
  foreach ($prop in $SqlInstances.PSObject.Properties) {
    if ($prop.Name -notmatch '^PS') {
      $instName = $prop.Name
      $regPath  = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$($prop.Value)\MSSQLServer\CurrentVersion"
      $ver      = (Get-ItemProperty $regPath -Name CurrentVersion -ErrorAction SilentlyContinue).CurrentVersion
      $vul = $true
      if ($ver) {
        $v = [version]$ver
        if (($v.Major -eq 13 -and $v -ge [version]'13.0.5337.0') -or
            ($v.Major -eq 14 -and $v -ge [version]'14.0.3162.1') -or
            ($v.Major -ge 15)) { $vul = $false }
      }
      $Results += [pscustomobject]@{
        Host=$env:COMPUTERNAME; Check='SQL Server CVE-2019-1068'; Instance=$instName
        Version=$ver; Vulnerable=$vul
        Action= if($vul){'Apply SQL Server CU per MS advisory CVE-2019-1068'}else{'Patched'}
      }
    }
  }
}

# ---- 2) AjaxPro (Ajax.NET Professional) assembly scan ----
# Vulnerable versions: AjaxPro < 21.11.3 (CVE-2021-23758 deserialization RCE)
$WebRoots = @('C:\inetpub\wwwroot')
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\InetStp' -ErrorAction SilentlyContinue | Out-Null
foreach ($root in $WebRoots) {
  Get-ChildItem -Path $root -Recurse -Filter 'AjaxPro*.dll' -ErrorAction SilentlyContinue | ForEach-Object {
    $fv = [version]($_.VersionInfo.FileVersion -replace '[^0-9.].*$','')
    $vul = ($fv -lt [version]'21.11.3')
    $Results += [pscustomobject]@{
      Host=$env:COMPUTERNAME; Check='AjaxPro CVE-2021-23758'; Instance=$_.FullName
      Version=$fv.ToString(); Vulnerable=$vul
      Action= if($vul){'Upgrade AjaxPro to >= 21.11.3 or remove; block ysoserial-style payloads at WAF'}else{'Patched'}
    }
  }
}

# ---- 3) TrueConf / Gitea presence check (Windows installs) ----
foreach ($svc in @('trueconf*','gitea*')) {
  Get-Service -Name $svc -ErrorAction SilentlyContinue | ForEach-Object {
    $Results += [pscustomobject]@{
      Host=$env:COMPUTERNAME; Check='TrueConf/Gitea presence'; Instance=$_.Name
      Version='n/a'; Vulnerable=$true
      Action='Verify version against CVE-2026-72529/72530/60004 advisories; restrict port 4307/TCP'
    }
  }
}

$Results | Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "[+] Audit complete. Report: $ReportPath" -ForegroundColor Green
$Results | Format-Table -AutoSize

Bash / Shell

#!/usr/bin/env bash
# Security Arsenal - Linux KEV Wave 2026-08-26 inventory (run via your fleet tooling)
# Checks: kernel (CVE-2022-0995), libuser (CVE-2015-3246), abrt (CVE-2015-5287),
#         Zimbra version (CVE-2026-73570), TrueConf port 4307 exposure

HOST=$(hostname); NOW=$(date -u +%FT%TZ)

# 1) Kernel version — CVE-2022-0995 fixed in 5.16.11/5.15.25/5.10.102 LTS branches
KVER=$(uname -r)
echo "$NOW,$HOST,kernel,$KVER,verify against vendor-fixed branch (>=5.10.102 / 5.15.25 / 5.16.11 or distro backport)"

# 2) libuser & abrt package versions (RHEL-family)
if command -v rpm >/dev/null; then
  rpm -q libuser abrt 2>/dev/null | while read -r p; do
    echo "$NOW,$HOST,pkg,$p,compare to RHSA-2015:1483 / RHSA-2015:1740 fixed builds"
  done
  # Debian-family alternative:
elif command -v dpkg >/dev/null; then
  dpkg -l libuser* abrt* 2>/dev/null | awk '/^ii/{print "'"$NOW,$HOST"',pkg,"$2" "$3",check distro tracker"}'
fi

# 3) Zimbra version (if installed)
if [ -x /opt/zimbra/bin/zmcontrol ]; then
  ZV=$(sudo -u zimbra /opt/zimbra/bin/zmcontrol -v 2>/dev/null | tr '\n' ' ')
  echo "$NOW,$HOST,zimbra,\"$ZV\",apply latest ZCS patch per Zimbra advisory (CVE-2026-73570)"
fi

# 4) TrueConf 4307/TCP exposure
ss -lnt 2>/dev/null | awk '$4 ~ /:4307$/{print "'"$NOW,$HOST"',trueconf,"port 4307 LISTENING","restrict to trusted networks + apply TrueConf update"}'

# 5) Gitea presence
if command -v gitea >/dev/null; then
  echo "$NOW,$HOST,gitea,$(gitea --version 2>/dev/null),update per Gitea advisory (CVE-2026-60004)"
fi

# 6) Quick compromise sanity checks
echo "--- /etc/passwd unexpected recent modification:"
stat -c '%y %n' /etc/passwd /etc/shadow 2>/dev/null
echo "--- Non-root processes writing shells under service users (last 50 auth anomalies):"
grep -E 'userhelper|abrt' /var/log/secure 2>/dev/null | tail -20

Patch & Remediation Priorities

Priority 1 — Patch/mitigate within 24–72 hours (internet-facing, pre-auth RCE):

CVE-2026-8452 — Citrix NetScaler ADC/Gateway. Apply the fixed builds in the Citrix security bulletin for this CVE immediately; after patching, assume compromise: hunt for webshells under /netscaler/portal/ and /var/vpn/, review ns.log for anomalous authentication, rotate all credentials that transited the appliance, and revoke active sessions. If patching is impossible, take the appliance offline. (Citrix support portal — search the CVE ID.)
CVE-2026-73570 — Zimbra ZCS. Apply the latest ZCS patch release per Zimbra's security advisory. Interim: restrict admin and mail service interfaces to trusted networks, enable strict WAF rules blocking shell metacharacters in request bodies, and audit /opt/zimbra/ for unexpected JSP/webapp artifacts.
CVE-2026-72529 + 72530 — TrueConf Server. Update TrueConf Server immediately; firewall port 4307/TCP to admin-trusted networks only as an interim control. These two should be treated as a single chained exploit.

Priority 2 — Patch within 7 days (post-auth RCE / access-control bypass on high-value tiers): 4. CVE-2026-21962 — Oracle HTTP Server/WebLogic Proxy Plug-in. Apply the current Oracle Critical Patch Update. Interim: tighten mod_wl_ohs path-matching rules and deny direct backend access. 5. CVE-2019-1068 — Microsoft SQL Server. Apply the applicable Cumulative Update (SQL 2016 SP2 CU7+ / SQL 2017 CU15+ or migrate to a supported version). Audit SQL service accounts for excessive domain privileges and disable xp_cmdshell where not required. 6. CVE-2026-60004 — Gitea. Update to the fixed release; audit repository write access, rotate CI/CD secrets stored in Gitea, and review recent patch/diff activity for anomalous submissions.

Priority 3 — Patch within 14 days (local privilege escalation — second-stage tooling): 7. CVE-2022-0995 — Linux Kernel. Update to kernel 5.10.102 / 5.15.25 / 5.16.11+ or your distro's backported build. Prioritize multi-user hosts, jump boxes, and anything reachable from web-tier compromise. 8. CVE-2015-3246 (libuser) & CVE-2015-5287 (ABRT). Apply RHSA-2015:1483 and RHSA-2015:1740 (or current equivalents). If these are unpatched in 2026, the hosts are almost certainly EOL — plan decommission or migration, not just patching. Interim: remove setuid from userhelper only after validating dependencies; disable ABRT on systems that don't need crash reporting. 9. CVE-2021-23758 — Ajax.NET Professional. Upgrade AjaxPro to 21.11.3+ or remove the dependency. Interim: WAF rules blocking __type-style type-discriminator payloads in JSON bodies to AjaxPro endpoints.

CISA compliance: All eleven CVEs carry a federal remediation due date of 2026-09-16 under BOD 22-01. Where vendor mitigations cannot be applied, BOD guidance directs discontinuation of the product — for this batch, that realistically applies to legacy AjaxPro-dependent applications and EOL RHEL systems.

Cross-cutting compensating controls: deploy the Sigma and KQL detections above before patching is complete; isolate any NetScaler, Zimbra, or SQL Server asset showing exploitation indicators and begin credential-rotation procedures (appliance compromise routinely precedes credential theft); and inventory shadow instances — Zimbra appliances spun up by departments, NetScalers in DR sites, and forgotten Gitea servers are the classic unpatched survivors.

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 11 CVEs Added — Citrix NetScaler, Zimbra, Linux Kernel & Microsoft SQL Server Under Active Attack