The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively exploiting them in real-world attacks.
Only one of the newly listed issues was disclosed in 2026. CVE-2026-8452 resides in NetScaler ADC and NetScaler Gateway, products widely used for application delivery and VPN connectivity. The flaw stems from improper memory handling and can cause a denial-of-service condition on devices with specific configurations.
The other five vulnerabilities were originally published in 2022 or earlier. CVE-2022-0995 affects the Linux Kernel event notification subsystem known as watch_queue. A local attacker can perform an out-of-bounds memory write, potentially overwriting kernel structures to gain elevated privileges or trigger a denial of service.
Red Hat products are also impacted. CVE-2015-5287 in the Automatic Bug Reporting Tool (ABRT) and CVE-2015-3246 in the libuser library both allow local privilege escalation. The libuser flaw can additionally corrupt the password file, leading to service disruption.
CISA continues to track exploitation of these issues and recommends that organizations apply vendor patches without delay and review system configurations to reduce exposure.
