# Six Years Old and Still Biting: CISA's Latest KEV Additions Should Embarrass Enterprise IT
When CISA drops six vulnerabilities into its Known Exploited Vulnerabilities catalog simultaneously, it's not a news cycle — it's a fire alarm. Wednesday's additions span Citrix NetScaler, the Linux kernel, and Microsoft SQL Server, and at least one of them has been sitting unpatched in production environments since the Obama administration's second term.
That's the story here. Not the catalog update itself, but what it says about how organizations actually handle vulnerability management when no one is watching.
## The NetScaler Problem That Never Goes Away
Citrix NetScaler ADC and NetScaler Gateway have become permanent residents of CISA's KEV catalog. If you've followed network edge security over the past three years, this shouldn't surprise you — it should concern you deeply.
NetScaler gear sits at the perimeter of thousands of enterprise, healthcare, and government networks. It's the front door. Threat actors — ransomware affiliates, Chinese APT groups, Iranian-linked actors — have learned that a compromised NetScaler appliance gives you a beachhead that's difficult to detect and even harder to dislodge. Unlike endpoint compromise, network appliance infections often survive reboots and evade traditional EDR coverage entirely.
The pattern since CitrixBleed (CVE-2023-4966) has been consistent: a critical NetScaler flaw drops, CISA adds it to KEV, federal agencies scramble, and a significant slice of commercial organizations does nothing for months. When researchers or vendors run internet-wide scans afterward, they routinely find tens of thousands of unpatched instances still exposed.
Wednesday's addition follows the same script. Whatever the specific CVE details turn out to be for this NetScaler flaw, the playbook for attackers is already written.
## CVE-2019-1068: The SQL Server Bug From Seven Years Ago
This is the one that demands a hard look in the mirror.
CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server. It was patched in July 2019. CISA is adding it to KEV in 2026 because there is active exploitation occurring right now — meaning real threat actors, in real intrusions, are using a vulnerability that has had a patch available for the better part of a decade.
SQL Server is not some niche product. It underpins billing systems, EHR platforms, financial applications, and core business logic across virtually every sector. The database tier is also frequently the most neglected layer of an organization's patching cadence. Application servers get attention. Endpoints get attention. The SQL Server instance that's been running in a VM since the Clinton administration? It gets restarted during power outages.
The exploitation of CVE-2019-1068 suggests a few things. First, some environments have SQL Server instances that are either directly internet-exposed or reachable after an initial foothold — and those instances haven't seen a patch cycle in years. Second, attackers have profiled which older, high-value vulnerabilities remain reliably unpatched at scale and are systematically working through that list.
This isn't opportunism. This is a playbook.
## Linux Kernel Entries Signal Sophisticated Actors
Linux kernel vulnerabilities appearing in the KEV catalog warrant particular attention. Unlike user-space application bugs, kernel vulnerabilities require a higher level of sophistication to weaponize reliably. When CISA cites active exploitation of a kernel flaw, it's generally not script kiddies — it's organized ransomware operations with experienced developers, or nation-state actors who need privilege escalation to complete an intrusion.
The operational implication: if you're running Linux infrastructure (and you are — cloud workloads, containers, virtualization hosts, industrial control system interfaces), kernel patching needs to leave the "we'll do it in the next maintenance window" bucket and enter the "this is a fire drill" category.
Distribution maintainers for Red Hat, Debian, Ubuntu, and others typically backport kernel patches quickly. The gap isn't usually patch availability — it's the organizational friction of rebooting production workloads to load a new kernel. That friction is now a documented attack surface.
## What CISA's KEV Actually Means (And What It Doesn't)
The KEV catalog is a binding operational directive for federal civilian executive branch agencies. They have 20 business days to remediate items on the list, or they need to get an exception approved. For the federal government, this is a meaningful compliance mechanism.
For the private sector? It's advisory. Which means the thousands of critical infrastructure operators, healthcare systems, financial institutions, and manufacturing firms that run the same software as federal agencies are under no legal obligation to act.
This is the KEV catalog's structural limitation. It's an excellent signal-to-noise filter — CISA requires evidence of actual exploitation, not just theoretical risk, before adding a CVE. But signal value doesn't automatically translate into remediation velocity outside the federal perimeter.
Security teams at regulated industries (financial services under FFIEC guidance, healthcare under HHS cyber performance goals) should treat KEV additions as effectively mandatory even without a direct legal hook. Your regulator's next examination will likely ask whether you track CISA KEV, and "we treat it as advisory" is not an answer that plays well.
## What Defenders Should Do This Week
The practical response to this KEV update, in priority order:
---
## HackWire Analysis
The buried story in Wednesday's KEV update is CVE-2019-1068, and it deserves more attention than it's getting.
Most coverage of KEV additions focuses on the newest, highest-severity entries — understandably. But a seven-year-old SQL Server RCE making it onto an active exploitation list in 2026 reveals something important about the vulnerability management gap at the database layer specifically.
In the post-COVID infrastructure sprawl, organizations stood up enormous amounts of new compute capacity while often neglecting legacy database infrastructure. SQL Server instances that powered on-premises applications in 2018 are still running, still internet-adjacent in some cases, and still unpatched. Attackers know this because they scan for it.
There's also a pattern worth naming: CISA's recent KEV additions increasingly include older CVEs alongside newer ones. This isn't coincidence — it reflects threat actor behavior shifting toward known-unpatched-at-scale rather than zero-day exploitation. Zero-days are expensive. Finding that 30% of a target sector's SQL Server installations haven't been patched since the Trump administration is free.
The NetScaler additions fit a different but related pattern: persistent exploitation of network edge appliances, which has become the dominant initial access vector for sophisticated intrusions since 2023. Until organizations start treating appliance patching with the same urgency they give endpoint patching — which requires solving the operational friction of rebooting production appliances — this will remain a reliable front door for threat actors.
Defenders should stop treating KEV as a compliance checklist and start treating it as a threat intelligence briefing. The catalog tells you what attackers are actually using, right now. Act accordingly.
— HackWire Editorial
---
## Related Coverage