CISA Adds Six Known Exploited Vulnerabilities Affecting NetScaler ADC, Linux Kernel and Microsoft SQL Server to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively exploiting them in real-world attacks.
Only one of the newly listed issues was disclosed in 2026. CVE-2026-8452 resides in NetScaler ADC and NetScaler Gateway, products widely used for application delivery and VPN connectivity. The flaw stems from improper memory handling and can cause a denial-of-service condition on devices with specific configurations.
The other five vulnerabilities were originally published in 2022 or earlier. CVE-2022-0995 affects the Linux Kernel event notification subsystem known as watch_queue. A local attacker can perform an out-of-bounds memory write, potentially overwriting kernel structures to gain elevated privileges or trigger a denial of service.
Red Hat products are also impacted. CVE-2015-5287 in the Automatic Bug Reporting Tool (ABRT) and CVE-2015-3246 in the libuser library both allow local privilege escalation. The libuser flaw can additionally corrupt the password file, leading to service disruption.
CISA continues to track exploitation of these issues and recommends that organizations apply vendor patches without delay and review system configurations to reduce exposure.
Related articles
Microsoft Issues Out-of-Band .NET Security Updates Fixing Brotli Buffer Overflow and Other Flaws
Microsoft has released out-of-band security updates for .NET 10, .NET 9, and .NET 8 to address multiple vulnerabilities. The patches cover two newly identified issues and complete remediation for two additional flaws that received incomplete fixes during the October 13 monthly update cycle. One critical vulnerability, CVE-2026-111497, affects the Brotli compression library and can lead to information disclosure, denial of service, or privilege escalation when processing crafted compressed data. A second issue, CVE-2026-114148, enables local privilege escalation in Linux distribution packages for ASP.NET Core due to improper ownership handling. Microsoft also reissued fixes for remote code execution vulnerabilities CVE-2026-70197 and CVE-2026-102870. Organizations are advised to apply the updates immediately, including rebuilding and redistributing applications in container or embedded environments.
Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate
Security NEXT published its weekly ranking of the ten most-read articles between October 18 and October 24 2026. The list is led by a critical GitLab vulnerability that also received back-port fixes for older branches. Multiple high-severity issues in the nginx web server, including three rated critical, took second place. PHP disclosed several serious flaws with an update scheduled for October 21, while Node.js prepared a security release for the same date. Additional entries covered actively exploited Fortinet and BeyondTrust vulnerabilities, Chrome 156 fixes for 353 issues, and U.S. government guidance urging immediate patching of PHP flaws or taking systems offline.
Critical SQL Injection Flaw in Arista VCO Already Exploited in Attacks
Arista Networks disclosed a critical SQL injection vulnerability in its VeloCloud Orchestrator product used for SD-WAN network management. The flaw, tracked as CVE-2026-114625, carries a CVSS v4.0 base score of 9.4 and a CVSS v3.1 score of 9.9, placing it in the highest severity category. Exploitation requires network access to the management interface and an authenticated session with Enterprise Read Only privileges or higher, after which attackers can escalate rights to reach internal management functions and compromise managed systems and data. The vendor has already observed active exploitation of the issue in the wild. Patches are available in versions 6.4.2.12, 6.1.3.10, and 5.2.3.18, and customers are urged to apply the updates immediately.
Researcher Develops Kernel Exploit for TP-Link EAP770 to Disable Faulty Qualcomm SFE Offload
A user who purchased the TP-Link EAP770 v1 Wi-Fi 7 access point in 2023 discovered persistent data corruption during large file transfers over Wi-Fi. The root cause was a DMA cache coherency bug in the Qualcomm qca-nss-dp driver combined with SFE/PPE hardware offload that recalculated TCP checksums on corrupted packets. TP-Link ended support for the v1 model before release and provided no firmware updates, while the device's restricted shell prevented the required sysfs writes. The researcher chained CVE-2022-0185 with pipe buffer manipulation to achieve root access, disable the offload features, and stop the corruption without bricking the device. The exploit was developed and tested first in QEMU using the closest available GPL kernel sources from the EAP783 model before being adapted to the live hardware. A separate unrelated bug was also found in the client Wi-Fi card firmware causing connection drops.