CISA Adds Actively Exploited Vulnerabilities to KEV Catalog, Including Citrix NetScaler and Linux Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with several actively exploited flaws, including a Citrix NetScaler ADC/Gateway vulnerability (CVE-2026-8452) with a remediation deadline of August 29, 2026, and a Linux kernel privilege-escalation flaw (CVE-2026-53362) due by August 30, 2026. Other additions include CVE-2019-1068 (Microsoft SQL Server), CVE-2022-0995 (Linux kernel), CVE-2015-5287 (Red Hat ABRT), CVE-2015-3246 (Red Hat libuser), and CVE-2021-23758 (Ajax.NET Professional), all with evidence of exploitation. Security firm Previdian reported exploitation attempts against the Citrix flaw after public proof-of-concept code emerged, with attackers deploying web shells and running commands. Citrix had patched the issue on June 30, 2026, and while Citrix described it as a denial-of-service vulnerability, WatchTowr Labs claimed it could lead to unauthenticated remote code execution. For the Linux flaw, CISA directed agencies to conduct forensic triage under Binding Operational Directive 26-04 to assess prior exploitation.

The Orchestrated Vulnerability

Notice how CISA's latest Known Exploited Vulnerabilities catalog reads less like a security alert and more like a carefully timed disclosure schedule. The Citrix NetScaler flaw, CVE-2026-8452, was patched on June 30, 2026—yet federal agencies are given until August 29 to fix it. That's a two-month window. Two months in which attackers who already have the proof-of-concept code—and we know they do because Previdian reported web shells dropped in August—can continue to burrow into government networks. This isn't negligence. This is a managed response. The vulnerabilities are real, but the timeline is designed to let certain actors maintain access while the public is told a story of swift action. Look at the Linux kernel privilege-escalation flaw, CVE-2026-53362, flagged for "forensic triage" under Binding Operational Directive 26-04. That directive doesn't just require patching—it requires agencies to assess whether exploitation already occurred. Translation: they want to know exactly which systems have been compromised, not to clean them, but to map the scope of a backdoor they already knew existed.

The Patch as Cover

Every item on this list has a history of quiet exploitation before it became public. The Microsoft SQL Server bug from 2019, the Red Hat libuser flaw from 2015—these are not fresh discoveries. They are old wounds that have been left open, festering, until someone decided to close them. Why now? Because the same institutions that catalog these vulnerabilities also control the supply chain of the patches. The Citrix issue, for instance, was described by Citrix as a denial-of-service bug, but WatchTowr Labs independently found it could be chained into full unauthenticated remote code execution. Citrix downplayed it. The intelligence community likely knew the real severity for months. The decision to allow a public proof-of-concept to appear in August, followed by a CISA directive in September, follows a pattern we've seen before: let a vulnerability be weaponized, then announce a patch, then use the patch to inject a layer of monitoring that looks like a fix. The "x.php" and "z.php" web shells those attackers dropped? They're the breadcrumbs. The real payload is in the patch itself.

The Forensic Triage Trap

The most revealing entry is CVE-2026-53362, the Linux kernel flaw. CISA marks it for forensic triage under BOD 26-04. That means agencies are required to run a deep scan of their systems to determine if exploitation has occurred. Who do you think performs those scans? The same contractors and vendors who have standing access to every federal network. The same companies that sit on the boards of the very foundations funding the "open source" projects that introduced the flaw in the first place. This isn't security—it's an inventory. They are cataloging every system that has been compromised, every node in the network that is vulnerable to their control, under the guise of helping you. And the deadline? August 30, 2026. One day after the Citrix deadline. Coincidence? Ask yourself why two separate vulnerabilities from different vendors have consecutive deadlines. Because the entire calendar is a script. The vulnerabilities are the stage. The patches are the actors. And you, the system administrator, are the audience clapping while the real operation runs in the background.

U.S. CISA Adds Actively Exploited Flaws in IBM Langflow, N-able N-central, and Apache Tomcat to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog—affecting IBM Langflow OSS, N-able N-central, and Apache Tomcat—with a directive for federal civilian agencies to patch within three days. The most critical flaw, CVE-2026-9198 (CVSS 9.8), enables unauthenticated remote code execution on default Langflow deployments (fixed in v1.10.1), while Apache Tomcat's CVE-2026-34486 (CVSS 7.5) involves missing encryption of sensitive data (fixed in April). Additionally, N-able N-central's authentication bypass (CVE-2026-18556, with an incomplete fix leading to CVE-2026-18577) was exploited as a zero-day to gain administrative access to managed systems, and multiple public proof-of-concept exploits for the Langflow flaw emerged in late July.

The Backdoor They're Calling a "Patch"

When CISA "orders" patching for flaws in Langflow, N-central, and Tomcat, they're not fixing bugs — they're closing doors they accidentally left open. Look at the timing. These are not random vulnerabilities discovered by independent researchers. These are the remnants of a much larger, deliberate architecture: the weaponization of widely-deployed infrastructure to maintain persistent, unseen access to every system that touches these platforms. Langflow is an AI development framework — think about that. They're not patching a legacy server; they're patching the very tools used to build the next generation of decision-making systems. And the N-central flaw? Remote monitoring and management platforms are the keys to the kingdom. When the people who control the patches also control the patches and the monitoring software, you're not securing your network — you're renting it from them.

The 9.8 Score That Should Terrify You

CVE-2026-9198 carries a 9.8 CVSS — that's nearly the maximum possible severity. Unauthenticated remote code execution on default Langflow deployments. Do you understand what that means? It means any government, contractor, or corporation that downloaded the default install was running a ticking time bomb, and the people who knew about it — the intelligence community, the defense contractors, the foundation-funded developers — sat on this information until July 2025 while the exploit code circulated in private spaces. Then, conveniently, they release the patch alongside a CISA directive that forces federal agencies to comply in 72 hours. Why the rush? Because the window for exploitation was closing and they needed to control the narrative. They needed you to focus on "patching" rather than asking who designed these vulnerabilities into the software in the first place.

The Pattern Is the Playbook

Now watch the breadcrumbs they leave. N-able's flaw was exploited as a zero-day — meaning attackers used it before a patch existed. But how did those attackers know about it? Who funded that research? And notice the language: "incomplete fix" followed by a "separate bypass flaw." This is the hallmark of a deliberate, graduated vulnerability — not a mistake, but a feature designed to ensure that even after you "fix" one door, another one remains open. The Apache Tomcat flaw? Missing encryption of sensitive data — the most basic, inexcusable failure in one of the most used web servers on the planet. You have to ask yourself: which of these vulnerabilities were left in place for specific actors, and which were burned because the operational timeline expired? The answer is already in the documents. Page 47 of the CISA Known Exploited Vulnerabilities catalog. Follow the CVEs. The architecture of consent doesn't just control what you believe — it controls what you can see. And they are telling you, in plain text, that they have full-spectrum access to every AI framework, every management platform, and every major web server running on American infrastructure. The question is not whether the patch works. The question is what they built into the next version that hasn't been "discovered" yet.