CISA Orders Immediate Patching of Multiple Actively Exploited Critical Vulnerabilities

Federal agencies must secure Citrix NetScaler, Oracle WebLogic, and Gitea instances against active remote code execution and cryptojacking campaigns.

August 27, 2026 · CISA, Cybersecurity, Patch Management, Ransomware

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a series of directives requiring federal agencies to patch multiple vulnerabilities currently being exploited in the wild. These flaws impact critical infrastructure components, including network appliances, web servers, and version control systems.

Citrix NetScaler Remote Code Execution

CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure affected Citrix NetScaler ADC and Gateway appliances by August 29. The vulnerability is a memory overflow that impacts instances configured with AAA (Authentication, Authorization, and Auditing) or Gateway VPN virtual servers.

There is a discrepancy regarding the severity of this flaw. According to Citrix, the vulnerability can lead to unpredictable behavior or denial-of-service (DoS) attacks and they have not observed unmitigated exploitation. However, cybersecurity firm WatchTowr demonstrated that the flaw allows for unauthenticated remote code execution as root. Following the publication of a proof-of-concept exploit by WatchTowr on August 14, Previdian and Defused reported observing active exploitation.

Previdian noted that attackers are dropping web shells named ‘x.php’ and ‘z.php’ to execute discovery commands like ‘id’ and ‘echo’. Telemetry shows 36 exploitation attempts across 12 unique IP addresses in countries including Russia, Germany, Japan, and the U.S. over a 12-day period. To remediate, administrators must apply patches for versions 14.1-72.61 (FIPS), 13.1-63.18, and 13.1-37.272.

Oracle WebLogic and Gitea Exploitation

CISA also flagged CVE-2026-21962 as a critical risk to Oracle WebLogic servers. This remote code execution flaw has a CVSS score of 10 and affects the Oracle HTTP Server and the WebLogic Server Proxy plugin. It can be exploited without authentication. According to SecurityWeek, CISA instructed federal agencies to address this by August 27; the vulnerability was patched in January 2026 updates.

Simultaneously, CISA warned of active exploitation of Gitea (CVE-2026-60004). This flaw allows an attacker with repository write access to execute arbitrary shell commands via the diffpatch endpoint. Because Gitea allows account registration by default, unauthenticated visitors can register, create a repository, and gain the necessary permissions to trigger the exploit.

According to The Hacker News, security researcher Shai rod (NightRang3r) discovered the issue. A developer named Andrey (@Causelof) reported that his Gitea instance was targeted by an unknown actor using the flaw to deploy a cryptocurrency-miner-like dropper on a HOSTKEY virtual server. The dropper script clears LD_PRELOAD and LD_LIBRARY_PATH, kills competing high-CPU processes, downloads a payload based on system architecture, executes it, and then deletes the file. Organizations should update to Gitea version 1.27.1 immediately.

China-Linked Threats and AI Integration

Several KEV additions highlight activity from Chinese-nexus threat actors. Broadcom VMware vCenter is impacted by CVE-2026-59310, a path traversal vulnerability allowing network-adjacent attackers to execute arbitrary code. According to The Hacker News, this has been used to deploy backdoors and reverse_ssh binaries for persistent access, in some cases leading to the deployment of Babuk-derived ransomware.

Microsoft Internet Key Exchange (IKE) Service Extensions are also under fire due to CVE-2026-33824. Palo Alto Networks Unit 42 observed a Chinese-speaking threat actor exploiting this double free vulnerability while simultaneously conducting an AI-enabled autonomous hacking campaign using DeepSeek.

Cisco Talos reported that the cybercrime group UAT-10147 is targeting Windows and Linux web servers globally across the technology, gaming, media, and education sectors. This group’s activity aligns with CISA’s observation that threat actors are increasingly utilizing artificial intelligence to automate exploitation efforts.

Additional Vulnerabilities in KEV Catalog

CISA also added several other flaws to the KEX catalog with varying deadlines for federal agencies:

• Microsoft SQL Server (CVE-2019-1068): Remote code execution vulnerability. Federal agencies must patch by August 29.
• Linux Kernel (CVE-2022-0995): Out-of-bounds memory write allowing local users to gain privileged access.
• Red Hat ABRT (CVE-2015-5287): Privilege escalation via a symlink attack.
• Red Hat libuser (CVE-2015-3246): Race condition allowing authenticated local users to corrupt the /etc/passwd file.
• Ajax.NET Professional (CVE-2021-23758): Deserialization of untrusted data leading to remote code execution.
• Apple macOS (CVE-2026-65400): Improper authentication allowing attackers on the network to access Screen Sharing without credentials; this has been used to deploy Monero miners.
• Microsoft SharePoint (CVE-2026-55040): Weak authentication flaw that allows unauthorized bypass of security features.

CISA notes that injection weaknesses were the dominant category of vulnerabilities in 2024 and 2025, with over 21,000 injection-related CVEs recorded in 2025 alone. The agency emphasizes that memory safety and improper input validation remain primary root causes for real-world exploitation.