Scope
This guide tackles the operational challenge of keeping patches up to date in production environments, focusing on vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV). It's aimed at security engineers and infrastructure teams responsible for managing vulnerability remediation timelines, patch deployment workflows, and system hardening across enterprise networks.
You'll find specific requirements, implementation frameworks, and a decision matrix to reference during incident response and routine maintenance windows.
Key Concepts and Definitions
CISA KEV Catalog: A dynamic list of Common Vulnerabilities and Exposures (CVEs) that CISA confirms are actively exploited. KEV listings trigger mandatory remediation deadlines for federal agencies under Binding Operational Directive 22-01.
Remediation Deadline: Federal Civilian Executive Branch agencies must patch KEV-listed vulnerabilities within 15 calendar days for new additions or by the agency-specified due date. While this timeline applies to government networks, it serves as a useful benchmark for private-sector risk prioritization.
CVSS Rating: The Common Vulnerability Scoring System rates vulnerabilities from 0.0 to 10.0. Scores of 7.0-8.9 indicate high severity; 9.0-10.0 indicate critical severity. KEV inclusion overrides CVSS for prioritization because exploitation evidence exists.
Patch Lag: The time between vendor patch availability and deployment in your environment. CVE-2019-1068 shows extreme patch lag with a seven-year gap between Microsoft's fix and ongoing exploitation.
Requirements Breakdown
CISA BOD 22-01 Mandates
Federal agencies must:
- Remediate KEV-listed vulnerabilities by the specified due date.
- Maintain an accurate asset inventory to identify affected systems.
- Report remediation status through continuous monitoring.
August 26 KEV Additions
CISA added six vulnerabilities with two distinct deadlines:
Tier 1 - August 29 deadline:
- CVE-2026-8452: Citrix NetScaler ADC/Gateway memory overflow (CVSS 8.8)
- CVE-2019-1068: Microsoft SQL Server remote code execution (CVSS 8.8)
Tier 2 - September 9 deadline:
- CVE-2015-3246: Red Hat Libuser race condition (CVSS 5.1)
- CVE-2015-5287: Red Hat automatic bug reporting tool privilege escalation (CVSS 7.8)
- CVE-2021-23758: Ajax.NET professional deserialization (CVSS 8.1)
- CVE-2022-0995: Linux kernel out-of-bounds write (CVSS 7.8)
Citrix Patched Versions
For CVE-2026-8452, deploy these minimum versions:
- NetScaler ADC/Gateway 14.1-72.61
- NetScaler ADC/Gateway 13.1-63.18
- NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272
This vulnerability affects appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Implementation Guidance
Asset Discovery and Mapping
Before patching, ensure comprehensive visibility. Build an inventory that captures:
- Product name and version number
- Configuration state (is this SQL server exposed to untrusted networks?)
- Business criticality tier
- Maintenance window availability
- Dependency mapping (what breaks if you patch this system?)
For CVE-2019-1068, identify any Microsoft SQL Server instance not updated since 2019. Query your configuration management database for SQL Server versions, then cross-reference against Microsoft's security update guide.
KEV Integration Workflow
Don't wait for your vulnerability scanner's signature update. Set up automated monitoring:
- Subscribe to CISA's KEV JSON feed.
- Parse new additions daily and cross-reference against your asset inventory.
- Auto-generate remediation tickets with pre-populated due dates.
- Escalate matches to your security operations center within four hours of KEV publication.
This automation closes the gap between CISA's announcement and your team's awareness.
Patch Deployment Sequencing
Prioritize based on exposure and exploitability:
Immediate (24-48 hours):
- Internet-facing systems matching KEV entries
- Systems processing sensitive personal data
- High-privilege infrastructure (domain controllers, certificate authorities)
Standard (within KEV deadline):
- Internal systems with network exposure
- Development and test environments that mirror production
Deferred (coordinate with change advisory board):
- Air-gapped systems
- End-of-life systems scheduled for retirement within 90 days
For CVE-2026-8452, if your NetScaler appliances serve external users through SSL VPN, they're immediate-tier targets. Internal AAA servers can follow standard sequencing.
Testing Requirements
Even under deadline pressure, validate patches in non-production first:
- Deploy to a representative test environment.
- Verify application functionality for at least 24 hours.
- Document rollback procedures before production deployment.
- Maintain configuration backups with tested restore processes.
For SQL Server patches like CVE-2019-1068, test query performance and replication behavior before touching production databases.
Common Pitfalls
Assuming CVSS Alone Determines Priority: CVE-2015-3246 has a moderate CVSS rating of 5.1, but KEV listing confirms active exploitation. Your scanner might deprioritize it while attackers are using it right now.
Ignoring End-of-Life Systems: If you're running SQL Server 2008 R2 (end-of-life April 2019), you can't patch CVE-2019-1068 through normal channels. You need compensating controls or accelerated migration, not perpetual exception requests.
Overlooking Configuration Context: CVE-2026-8452 only affects NetScaler appliances in specific configurations. Don't skip the patch, but understand that a NetScaler running only as a load balancer without Gateway features has reduced exposure.
Treating KEV as the Complete Threat Picture: KEV lists confirmed exploitation, not all dangerous vulnerabilities. Continue your regular patch cadence for non-KEV items based on CVSS, asset criticality, and threat intelligence.
Patch-and-Forget Mentality: Deploying the update is half the job. Verify the patch installed successfully, confirm the vulnerable code path is no longer accessible, and update your asset inventory with the new version number.
Quick Reference Table
| CVE | Product | Severity | Attack Vector | Deadline | Minimum Patched Version |
|---|---|---|---|---|---|
| CVE-2026-8452 | Citrix NetScaler ADC/Gateway | 8.8 | Network | Aug 29 | 14.1-72.61 or 13.1-63.18 |
| CVE-2019-1068 | Microsoft SQL Server | 8.8 | Network | Aug 29 | See MS19-4057 |
| CVE-2015-3246 | Red Hat Libuser | 5.1 | Local | Sep 9 | RHSA-2015:1482 |
| CVE-2015-5287 | Red Hat ABRT | 7.8 | Local | Sep 9 | RHSA-2015:1930 |
| CVE-2021-23758 | Ajax.NET Professional | 8.1 | Network | Sep 9 | Version 21.2.172.1 |
| CVE-2022-0995 | Linux Kernel | 7.8 | Local | Sep 9 | Kernel 5.16.15+ |
Decision Matrix for Patch Prioritization:
IF system matches KEV + internet-facing → Deploy within 48 hours
IF system matches KEV + internal only → Deploy within deadline
IF CVSS ≥ 9.0 + no KEV listing → Deploy within 30 days
IF CVSS 7.0-8.9 + no KEV listing → Deploy within 60 days
IF end-of-life system → Isolate or migrate, don't wait for patches
Keep this guide accessible during your next maintenance window. When CISA adds new KEV entries, you'll have a repeatable process instead of an ad-hoc scramble.
