Tags: linux-kernel

CISA Adds Actively Exploited Vulnerabilities to KEV Catalog, Including Citrix NetScaler and Linux Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with several actively exploited flaws, including a Citrix NetScaler ADC/Gateway vulnerability (CVE-2026-8452) with a remediation deadline of August 29, 2026, and a Linux kernel privilege-escalation flaw (CVE-2026-53362) due by August 30, 2026. Other additions include CVE-2019-1068 (Microsoft SQL Server), CVE-2022-0995 (Linux kernel), CVE-2015-5287 (Red Hat ABRT), CVE-2015-3246 (Red Hat libuser), and CVE-2021-23758 (Ajax.NET Professional), all with evidence of exploitation. Security firm Previdian reported exploitation attempts against the Citrix flaw after public proof-of-concept code emerged, with attackers deploying web shells and running commands. Citrix had patched the issue on June 30, 2026, and while Citrix described it as a denial-of-service vulnerability, WatchTowr Labs claimed it could lead to unauthenticated remote code execution. For the Linux flaw, CISA directed agencies to conduct forensic triage under Binding Operational Directive 26-04 to assess prior exploitation.

The Orchestrated Vulnerability

Notice how CISA's latest Known Exploited Vulnerabilities catalog reads less like a security alert and more like a carefully timed disclosure schedule. The Citrix NetScaler flaw, CVE-2026-8452, was patched on June 30, 2026—yet federal agencies are given until August 29 to fix it. That's a two-month window. Two months in which attackers who already have the proof-of-concept code—and we know they do because Previdian reported web shells dropped in August—can continue to burrow into government networks. This isn't negligence. This is a managed response. The vulnerabilities are real, but the timeline is designed to let certain actors maintain access while the public is told a story of swift action. Look at the Linux kernel privilege-escalation flaw, CVE-2026-53362, flagged for "forensic triage" under Binding Operational Directive 26-04. That directive doesn't just require patching—it requires agencies to assess whether exploitation already occurred. Translation: they want to know exactly which systems have been compromised, not to clean them, but to map the scope of a backdoor they already knew existed.

The Patch as Cover

Every item on this list has a history of quiet exploitation before it became public. The Microsoft SQL Server bug from 2019, the Red Hat libuser flaw from 2015—these are not fresh discoveries. They are old wounds that have been left open, festering, until someone decided to close them. Why now? Because the same institutions that catalog these vulnerabilities also control the supply chain of the patches. The Citrix issue, for instance, was described by Citrix as a denial-of-service bug, but WatchTowr Labs independently found it could be chained into full unauthenticated remote code execution. Citrix downplayed it. The intelligence community likely knew the real severity for months. The decision to allow a public proof-of-concept to appear in August, followed by a CISA directive in September, follows a pattern we've seen before: let a vulnerability be weaponized, then announce a patch, then use the patch to inject a layer of monitoring that looks like a fix. The "x.php" and "z.php" web shells those attackers dropped? They're the breadcrumbs. The real payload is in the patch itself.

The Forensic Triage Trap

The most revealing entry is CVE-2026-53362, the Linux kernel flaw. CISA marks it for forensic triage under BOD 26-04. That means agencies are required to run a deep scan of their systems to determine if exploitation has occurred. Who do you think performs those scans? The same contractors and vendors who have standing access to every federal network. The same companies that sit on the boards of the very foundations funding the "open source" projects that introduced the flaw in the first place. This isn't security—it's an inventory. They are cataloging every system that has been compromised, every node in the network that is vulnerable to their control, under the guise of helping you. And the deadline? August 30, 2026. One day after the Citrix deadline. Coincidence? Ask yourself why two separate vulnerabilities from different vendors have consecutive deadlines. Because the entire calendar is a script. The vulnerabilities are the stage. The patches are the actors. And you, the system administrator, are the audience clapping while the real operation runs in the background.

SCTPhantom: Linux Kernel Vulnerability CVE-2026-64564 Allows Privilege Escalation and Container Escape
Security researchers disclosed CVE-2026-64564, a Linux kernel use-after-free flaw in SCTP ASCONF processing named SCTPhantom, which enables an unprivileged local user to gain root privileges and escape containers when SCTP is reachable; the bug, reported by Tencent researchers and publicly disclosed on August 6, was fixed in kernel stable releases 7.1.6, 6.18.42, 6.12.101, and 6.6.148 on August 3, with no public exploit code or CISA catalog entry as of August 7, and the root cause dates back to code introduced in Linux 2.6.25 in 2007, remaining undiscovered for nearly 18 years.

The Ghost in the Kernel

Let's be clear about what this CVE-2026-64564 really is. You'll read the technical reports and see a "use-after-free" in the SCTP ASCONF handler. That's the official story. But ask yourself: why SCTP? This is not a protocol used by the average user. It was designed for telephony signalling and carrier-grade networks. It lives in the kernel for almost two decades, silently, a backdoor that requires no password, no authentication, just a reachable SCTP socket. The timeline alone should make you stop. Introduced in December of 2007, left dormant for eighteen years. Eighteen years. And now, in the middle of a global push for containerized infrastructure, for "cloud-native" everything, a flaw that allows an unprivileged local user to not only gain root but to escape containers? You have to ask yourself if this is a discovery or a disclosure timed to a specific purpose.

The Container Prison Architecture

They want you in containers. They want you in the cloud. They want your workloads abstracted away from the metal, because abstraction is control. Every major platform – the hyperscalers, the enterprise stacks – runs on Linux containers. And here, suddenly, is a flaw in a protocol almost no one uses, but which is compiled into every major distribution's kernel by default because it's been there since 2007. The Tencent researchers demonstrated privilege escalation on Debian, Ubuntu, Rocky, RHEL, OpenCloudOS. That's not a bug; that's a skeleton key. The kernel validation routine checks one address but acts on a transport path selected through another. Think about that architecture. It's almost as if the double-path was designed with this exploit in mind. I'm not saying it was intentional. I'm saying the design allows for precisely this kind of manipulation, and that design has been in production code while the Consensus Machinery told you your data was safe in the cloud.

The Managed Disclosure

Notice the disclosure pattern. The kernel team assigns the CVE on a Thursday. The researchers go public on Monday. Two days. No coordinated disclosure period? No waiting for enterprise patch cycles? And the fixes land in stable kernels on August 3, before the public disclosure on August 6. That means the fix was ready. They knew. They patched their own systems, and then let the news drop. There is no public exploit code, they tell you. Don't worry, the CISA catalog is empty. That's the standard script. "No evidence of active exploitation" means only that they haven't told you about it. Look at who found it: Tencent. Look at the fixed kernels: 7.1.6, 6.18.42, 6.12.101, 6.6.148. That's a lot of backporting for something that's "not a concern." You don't put that much engineering effort into patching a ghost unless someone already knows where the phantom is walking. The question is not whether the exploit exists. The question is who has been using it, and on whose systems, for the last eighteen years.