--- title: "Security digest: August 26, 2026" url: https://erroneo.us/security/2026-08-26/ description: "August 26, 2026 vulnerability digest: 6 CISA KEV additions (Ajax.NET Professional, Citrix, Linux…); 6 critical advisories (Maven, PyPI, Go). What to patch…" type: security-digest-day section: "Security Digest" date_published: 2026-08-26 date_modified: 2026-08-26 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: August 26, 2026 6 known exploited (cisa kev) additions and 6 critical advisories. ## Take stock - Do you run any of these? Citrix NetScaler ADC and NetScaler Gateway, Linux Kernel, Ajax.NET Professional Ajax.NET Professional, Microsoft SQL Server, Red Hat Automatic Bug Reporting Tool, Red Hat Libuser. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-29. - Maven: 3 critical advisories ( org.springframework:spring-webmvc , org.springframework:spring-webflux ). Check with mvn dependency:tree -Dincludes=: . - PyPI: 2 critical advisories ( senaite.core , pantheon-agents ). Check with pip-audit (or: pip show ) . - Go: 1 critical advisory ( github.com/kyverno/kyverno ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2026-8452](https://erroneo.us/security/cve/CVE-2026-8452/index.md) Citrix NetScaler ADC and NetScaler Gateway: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CISA due 2026-08-29) - [CVE-2022-0995](https://erroneo.us/security/cve/CVE-2022-0995/index.md) Linux Kernel: Linux Kernel Out-of-Bounds Write Vulnerability (CISA due 2026-08-29) - [CVE-2021-23758](https://erroneo.us/security/cve/CVE-2021-23758/index.md) Ajax.NET Professional Ajax.NET Professional: Ajax.NET Professional Deserialization of Untrusted Data Vulnerability (CISA due 2026-09-09) - [CVE-2019-1068](https://erroneo.us/security/cve/CVE-2019-1068/index.md) Microsoft SQL Server: Microsoft SQL Server Remote Code Execution Vulnerability (CISA due 2026-08-29) - [CVE-2015-5287](https://erroneo.us/security/cve/CVE-2015-5287/index.md) Red Hat Automatic Bug Reporting Tool: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability (CISA due 2026-09-09) - [CVE-2015-3246](https://erroneo.us/security/cve/CVE-2015-3246/index.md) Red Hat Libuser: Red Hat Libuser Race Condition Vulnerability (CISA due 2026-09-09) ## Critical advisories - [CVE-2026-47884](https://erroneo.us/security/cve/CVE-2026-47884/index.md) Spring Framework Improper Path Limitation in XsltView — Maven org.springframework:spring-webmvc <= 5.2.25.RELEASE → no fix; Maven org.springframework:spring-webmvc >= 5.3.0, <= 5.3.49 → no fix; Maven org.springframework:spring-webmvc >= 6.0.0, <= 6.0.30 → no fix - [CVE-2026-54569](https://erroneo.us/security/cve/CVE-2026-54569/index.md) senaite.core Vulnerable to Eval Injection and Missing Authorization — PyPI senaite.core >= 2.0.0, <= 2.6.0 → no fix - [CVE-2026-47890](https://erroneo.us/security/cve/CVE-2026-47890/index.md) Spring Framework Server Sent Event stream corruption while rendering fragments — Maven org.springframework:spring-webflux >= 6.2.0, <= 6.2.19 → no fix; Maven org.springframework:spring-webflux >= 7.0.0, <= 7.0.8 → 7.0.9; Maven org.springframework:spring-webmvc >= 6.2.0, <= 6.2.19 → no fix - [CVE-2026-47892](https://erroneo.us/security/cve/CVE-2026-47892/index.md) Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints — Maven org.springframework:spring-webflux >= 5.2.5.RELEASE, <= 5.2.25.RELEASE → no fix; Maven org.springframework:spring-webflux >= 5.3.0, <= 5.3.49 → no fix; Maven org.springframework:spring-webflux >= 6.0.0, <= 6.0.30 → no fix - [GHSA-93qj-5q5v-3c2h](https://erroneo.us/security/ghsa/GHSA-93qj-5q5v-3c2h/index.md) Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise) — PyPI pantheon-agents >= 0.6.1, <= 0.6.2 → 0.6.4 - [CVE-2026-54523](https://erroneo.us/security/cve/CVE-2026-54523/index.md) Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system — Go github.com/kyverno/kyverno >= 1.18.0, <= 1.18.1 → 1.18.2 --- Source page: https://erroneo.us/security/2026-08-26/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt