CISA Adds Six Exploited Flaws to KEV, Highlighting NetScaler, Linux and SQL Server Risks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Wednesday that six additional vulnerabilities have been added to its Known Exploited Vulnerabilities (KEV) catalog. The update places a spotlight on a high‑severity flaw in Citrix NetScaler ADC and NetScaler Gateway, as well as new threats targeting Linux operating systems and Microsoft SQL Server. Organizations that rely on these technologies are urged to assess exposure and apply patches without delay.

CISA expands KEV catalog with six new exploits

CISA’s KEV list serves as a curated set of vulnerabilities that are known to be actively exploited in the wild. By flagging these flaws, the agency helps federal agencies and private sector partners prioritize remediation efforts. The latest addition brings the total count of KEV entries to over 200, reflecting the accelerating pace of cyber attacks.

Overview of the added vulnerabilities

CVE-2019-1068 – A remote code execution (RCE) flaw in a popular web server component that allows attackers to execute arbitrary code with system privileges.
Citrix NetScaler ADC and Gateway vulnerability – A critical RCE issue that can be triggered remotely, giving threat actors the ability to take control of the appliance and pivot to internal networks.
Linux kernel privilege‑escalation bug – A flaw in the kernel’s memory management subsystem that enables local users to gain root privileges.
Microsoft SQL Server authentication bypass – An error in the authentication flow that permits attackers to connect without valid credentials.
Additional Linux container escape vulnerability – Exploits a misconfiguration in container runtimes, allowing escape to the host system.
Secondary SQL Server data‑exfiltration weakness – A flaw that can be abused to extract sensitive database content over the network.

Each entry includes references to public advisories, proof‑of‑concept exploits, or observed malicious activity. CISA’s decision to add them to KEV indicates that these vulnerabilities are not merely theoretical; they have been leveraged by real‑world threat actors.

Why the KEV list matters for defenders

Security teams often face an overwhelming number of CVEs each year. The KEV catalog narrows the field to those that pose the greatest immediate risk. By focusing on KEV items, organizations can allocate limited resources to patching the most dangerous flaws first.

Federal guidance requires agencies to remediate KEV vulnerabilities within 30 days of publication. While the mandate applies to government entities, many private companies adopt the same timeline as a best practice.

Impact on network perimeter and remote access

The NetScaler vulnerability is particularly concerning because the appliance frequently sits at the edge of corporate networks, handling inbound traffic for web applications, VPN connections and cloud workloads. Compromise of NetScaler can give attackers a foothold that bypasses traditional perimeter defenses.

Linux kernel and container bugs affect a broad spectrum of environments, from on‑premises servers to cloud‑native workloads. A successful privilege‑escalation exploit can turn a low‑privilege account into a full‑blown root compromise, enabling further lateral movement.

SQL Server authentication bypasses undermine database integrity and confidentiality. Databases often store personally identifiable information, financial records and intellectual property; any breach can have severe regulatory and reputational consequences.

Deep dive into high‑risk entries

Citrix NetScaler ADC and Gateway flaw

Citrix has issued an advisory that describes the vulnerability as a remote code execution issue in the management interface. The flaw stems from insufficient input validation when processing specially crafted HTTP requests. Successful exploitation grants attackers system‑level access to the appliance.

Mitigation steps include applying the latest firmware update released by Citrix, restricting access to the management console through network segmentation, and enabling multi‑factor authentication for administrative accounts.

Linux kernel privilege‑escalation bug

The kernel bug resides in the memory allocation subsystem. A crafted sequence of system calls can corrupt kernel data structures, leading to arbitrary code execution with root privileges. The issue affects multiple Linux distributions that ship the affected kernel version.

Linux vendors have published patches that backport the fix to older kernel releases. Administrators should verify the kernel version in use and apply the appropriate update from the distribution’s security repository.

Microsoft SQL Server authentication bypass

Microsoft’s security advisory details a flaw in the authentication handshake that can be abused to bypass credential checks. The vulnerability is exploitable over the network and does not require prior access to the server.

Applying the cumulative security update released in the latest Patch Tuesday cycle resolves the issue. In addition, organizations should enforce strong password policies, enable encryption for client‑server connections, and monitor login attempts for anomalous patterns.

Practical steps for immediate remediation

Identify affected assets by cross‑referencing inventory with the CVE identifiers listed above.
Prioritize patch deployment for NetScaler appliances, Linux servers and SQL Server instances that are exposed to untrusted networks.
Validate that firmware and software updates have been successfully applied using vendor verification tools.
Implement network segmentation to limit access to critical management interfaces.
Enable multi‑factor authentication for all privileged accounts.
Monitor security logs for indicators of exploitation, such as unexpected outbound connections from patched systems.

For organizations that cannot patch immediately, temporary mitigations such as firewall rule changes, disabling vulnerable services, or applying vendor‑provided workarounds can reduce the attack surface.

Resources for further guidance

Security professionals can consult the following authoritative sources for detailed technical information and remediation guidance:

Staying current with these resources helps organizations maintain a proactive security posture and reduces the likelihood of successful exploitation.

By addressing the newly added KEV entries promptly, enterprises can protect critical infrastructure, safeguard sensitive data and mitigate the financial impact of a breach.