CISA Adds Six Actively Exploited Vulnerabilities to Known Exploited Vulnerabilities (KEV) Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six new flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These vulnerabilities include a high-severity remote code execution flaw in Microsoft SQL Server (CVE-2019-1068), an improper restriction of operations within memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-8452), and an out-of-bounds memory write vulnerability in the Linux Kernel (CVE-2022-0995). CISA is urging Federal Civilian Executive Branch (FCEB) agencies to apply fixes for CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and for the remaining vulnerabilities by September 9, 2026.