CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, notably CVE-2026-8452 affecting Citrix NetScaler ADC/Gateway, which has evidence of active exploitation where attackers dropped web shells ('x.php' and 'z.php') and ran discovery commands. Telemetry reported 36 exploitation attempts from 12 unique IPs across multiple countries; CISA set expedited remediation deadlines and the report references related activity by a Chinese cybercrime group targeting web servers globally.