Six vulnerabilities landed on CISA’s exploited list on the same day. One of them is old enough to vote.
The batch, in full
On August 26, CISA added six flaws to its Known Exploited Vulnerabilities catalogue: CVE-2015-3246 (a race condition in Red Hat’s libuser library), CVE-2015-5287 (a privilege escalation bug in Red Hat’s Automatic Bug Reporting Tool), CVE-2019-1068 (a remote code execution flaw in Microsoft SQL Server’s internal function handling), CVE-2021-23758 (an insecure deserialization vulnerability in the Ajax.NET Professional library used by older .NET web applications), CVE-2022-0995 (an out-of-bounds write in the Linux kernel), and CVE-2026-8452, the Citrix NetScaler bug we covered separately this week that’s already tied to webshells in the wild. Federal civilian agencies had until August 29 to patch the SQL Server and NetScaler flaws, and have until September 9 for the rest.
Why the old ones are the real story
A fresh zero-day gets attention because nobody had a chance to patch it. A ten-year-old race condition in libuser getting actively exploited in 2026 means the opposite: patches have existed for over a decade, and someone is still running the vulnerable version. CVE-2019-1068 requires an authenticated attacker to submit a crafted query to a SQL Server instance and can hand over code execution in the context of the database engine’s service account, exactly the kind of internal-network foothold that turns one compromised credential into a database takeover. CVE-2021-23758 lets an unauthenticated attacker achieve remote code execution against any web application still running an old AjaxPro.2 build, no login required. These aren’t edge cases, they’re the systems that stayed running because nobody’s inventory flagged them and nobody’s deprecation plan reached them.
The European angle
NIS2 makes asset inventory and vulnerability management explicit obligations for organisations in scope, not best-practice suggestions. A CISA KEV batch built mostly from CVEs older than some of your junior engineers is a useful test of whether your inventory actually catches what’s running versus what you think is running. Legacy SQL Server instances behind an internal firewall, an old .NET application nobody has touched since a vendor stopped supporting it, a Linux box running a kernel from before the last two LTS cycles, these are exactly the systems that internal network segmentation was supposed to protect and exactly the systems attackers now specifically hunt for once perimeter defences have improved everywhere else.
What to check this week
Cross-reference this batch against your own environment, not just your internet-facing assets. Ask whether any SQL Server instance, however old, is reachable from anything other than the specific application that needs it. Check for AjaxPro.2 or Ajax.NET Professional in any legacy .NET web app your organisation still runs, even ones maintained by a third party. And treat a KEV listing with a 2015 CVE number as what it is: proof that “it’s old, it’s probably fine” is the assumption attackers are counting on.
If you need a real asset inventory, not a spreadsheet nobody’s updated since the last audit, or want your legacy systems checked against the current KEV catalogue, contact Excello Digital. We help European organisations find the decade-old vulnerability before an attacker does.