CISA Adds CVE-2026-8452 to KEV Catalog and Orders Federal Agencies to Patch Citrix NetScaler by August 29 2026
CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog, forcing US federal agencies to patch Citrix NetScaler before the strict deadline of August 29 2026.
The vulnerability affects NetScaler ADC and NetScaler Gateway when the appliance operates as a VPN Gateway or AAA virtual server. These perimeter devices provide remote access to corporate networks, making them high-value targets for attackers seeking initial entry points.
Originally described by Citrix as a memory overflow capable of causing erratic behavior and denial of service, the issue was later shown through public technical analysis to support unauthenticated remote code execution with root privileges on unpatched systems.
The attack surface expands significantly in environments using SAML, whether the device functions as a Service Provider or Identity Provider, particularly in single sign-on deployments.
Observed campaigns follow a spray-and-pray pattern, with attackers deploying webshells after successful compromise and executing basic reconnaissance commands to map the environment.
With tens of thousands of NetScaler devices exposed to the internet, many configured as public Gateway instances, the flaw is expected to trigger widespread automated scanning and exploitation attempts.
Citrix has released corrected builds that close the vulnerability, including version 14.1-72.61, 13.1-63.18, and 13.1-37.272 or higher for FIPS and NDcPP configurations.
Defensive recommendations include immediate inventory of exposed instances, verification of actual software versions and configurations, active hunting for webshells and reconnaissance indicators, and implementation of network segmentation and administrative access restrictions where patching cannot be completed instantly.
Related articles
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency has added three vulnerabilities with confirmed in-the-wild exploitation to its Known Exploited Vulnerabilities catalog. The flaws affect Cisco Identity Services Engine, its Passive Identity Connector, and Acronis Backup plugins for cPanel and Plesk. All three entries carry a remediation deadline of September 19, 2026. The Cisco issue stems from insufficient authentication controls on an API endpoint that lets remote attackers bypass the web-based management interface. The Acronis vulnerability arises from overly permissive default settings in server-management plugins, enabling privilege escalation. Federal agencies have been directed to investigate potential compromises and apply mitigations without delay.