Digest · Wednesday

Security digest: August 26, 2026

6 known exploited (cisa kev) additions and 6 critical advisories.

Take stock

Do you run any of these? Citrix NetScaler ADC and NetScaler Gateway, Linux Kernel, Ajax.NET Professional Ajax.NET Professional, Microsoft SQL Server, Red Hat Automatic Bug Reporting Tool, Red Hat Libuser. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-29.
Maven: 3 critical advisories (org.springframework:spring-webmvc, org.springframework:spring-webflux). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
PyPI: 2 critical advisories (senaite.core, pantheon-agents). Check with pip-audit (or: pip show <package>).
Go: 1 critical advisory (github.com/kyverno/kyverno). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2026-8452	Citrix NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	2026-08-29
CVE-2022-0995	Linux Kernel Linux Kernel Out-of-Bounds Write Vulnerability	2026-08-29
CVE-2021-23758	Ajax.NET Professional Ajax.NET Professional Ajax.NET Professional Deserialization of Untrusted Data Vulnerability	2026-09-09
CVE-2019-1068	Microsoft SQL Server Microsoft SQL Server Remote Code Execution Vulnerability	2026-08-29
CVE-2015-5287	Red Hat Automatic Bug Reporting Tool Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability	2026-09-09
CVE-2015-3246	Red Hat Libuser Red Hat Libuser Race Condition Vulnerability	2026-09-09

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Spring Framework Improper Path Limitation in XsltView CVE-2026-47884 CVSS 9.8 Critical
org.springframework:spring-webmvc <= 5.2.25.RELEASE → no fix listed; org.springframework:spring-webmvc >= 5.3.0, <= 5.3.49 → no fix listed; org.springframework:spring-webmvc >= 6.0.0, <= 6.0.30 → no fix listed; +3 more packages
Spring Framework Server Sent Event stream corruption while rendering fragments CVE-2026-47890 CVSS 9.8 Critical
org.springframework:spring-webflux >= 6.2.0, <= 6.2.19 → no fix listed; org.springframework:spring-webflux >= 7.0.0, <= 7.0.8 → fixed in 7.0.9; org.springframework:spring-webmvc >= 6.2.0, <= 6.2.19 → no fix listed; +1 more packages
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-47892 CVSS 9.8 Critical
org.springframework:spring-webflux >= 5.2.5.RELEASE, <= 5.2.25.RELEASE → no fix listed; org.springframework:spring-webflux >= 5.3.0, <= 5.3.49 → no fix listed; org.springframework:spring-webflux >= 6.0.0, <= 6.0.30 → no fix listed; +3 more packages

Check: pip-audit (or: pip show <package>)

senaite.core Vulnerable to Eval Injection and Missing Authorization CVE-2026-54569 CVSS 9.8 Critical
senaite.core >= 2.0.0, <= 2.6.0 → no fix listed
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise) GHSA-93qj-5q5v-3c2h
pantheon-agents >= 0.6.1, <= 0.6.2 → fixed in 0.6.4

Check: govulncheck ./...

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any… CVE-2026-54523 CVSS 9.6 Critical
github.com/kyverno/kyverno >= 1.18.0, <= 1.18.1 → fixed in 1.18.2