The Patches Are Out. The Gear Is Still Broken.

# The Patches Are Out. The Gear Is Still Broken. I spend my mornings reading changelogs because they're more honest than press releases. A vendor will tell you a patch "improves stability," while the CVE entry reveals it actually stops an unauthenticated attacker from owning your kernel. This week, CISA added ten entries to the Known Exploited Vulnerabilities (KEV) catalog. Most of these are noise for the average admin, but two are not. If you're managing a perimeter and you haven't touched your NetScaler or Gitea instances since Sunday, you aren't "monitoring the situation." You're just waiting to be indexed by an attacker. The absolute priority is CVE-2026-8452 in Citrix NetScaler ADC and Gateway. CISA added it to the KEV on August 26 with a federal patch deadline of August 29. That gives you three days. Given that these appliances sit at the edge, any delay is an invitation. I don't care if your internal risk score calls this "high" or "critical"—those are adjectives. The fact is that it’s being exploited in the wild and it controls your front door. Patch to the latest fixed version immediately. Second on the list is Gitea (CVE-2026-60004), added to the KEV on August 25. It's a code injection flaw. Reports indicate attackers are dropping miner-like payloads, which is usually just the noise they make while they look for something more valuable in your repositories. If your Gitea instance is public-facing, you’ve already lost the lead. Then we have the "can wait" pile. CISA added several entries this week that feel like archaeology. We're seeing CVE-2015-3246 and CVE-2015-5287 for Red Hat Libuser and the Automatic Bug Reporting Tool. These are eleven years old. Unless you're maintaining a legacy environment so fragile that a reboot would cause a catastrophic failure, these don't jump the queue over NetScaler. The same applies to CVE-2021-23758 in Ajax.NET Professional. The logic here is simple: prioritize based on exposure and active exploitation. An eleven-year-old bug in a legacy library is a problem for the person who refused to upgrade their OS since the Obama administration; an active RCE in your edge gateway is a problem for everyone. Some people will argue that we should patch everything simultaneously to avoid "technical debt." That's a fine sentiment for a textbook, but it's an impossible strategy in production. If you try to treat every KEV addition as an emergency, you end up with "alert fatigue," which is just a fancy way of saying you've stopped paying attention. The real-world cost of this fatigue isn't found in a PDF report; it's found in the supply chain. Look at Boston Scientific. They’ve been the center of 28 separate stories this week, primarily because their cyberattack has halted shipments. When a vulnerability analyst sees "shipment delays" for medical devices, that's when the word 'critical' is actually earned. The second-order effect here isn't just data loss—it's a hospital in some mid-sized city unable to get a replacement valve or pacemaker because someone’s environment was compromised. The attacker doesn't need to encrypt every server if they can just break the logistics chain and let the physical world do the rest of the damage. It's a recurring theme. We saw this with the move toward "just-in-time" inventory in manufacturing. When you strip away all the buffers to save a few percentage points on overhead, you ensure that any digital hiccup becomes a physical crisis. The attackers know this. They aren't just targeting data; they're targeting the friction points of global trade. For those wondering why CISA is suddenly flagging bugs from 2015 and 2019—like CVE-2019-1068 in MS SQL Server—the answer is usually that a new exploit kit has integrated them. Attackers don't care about the "vintage" of a bug; they care if it works on your specific version of SQL Server. The parallel here is the 2017 WannaCry outbreak, where old SMB flaws were weaponized at scale. The difference now is that we have better telemetry, but our patching cadence still hasn't caught up to the speed of automated scanning. If you’re staring at your dashboard and seeing a sea of red, stop. Ignore the internal severity scores for a moment and look at the KEV dates. Patch NetScaler first. Patch Gitea second. If you have time on Friday, go dig through your legacy Red Hat boxes to see if you're running something from 2015. If you are, you have bigger problems than this column can solve. The question we should be asking isn't why these bugs exist, but why we still trust edge appliances that require a manual update every time a new script-kiddie finds a path traversal flaw. I suspect the answer is that it's easier to patch a server than it is to rethink an entire network architecture. Check your versions. NetScaler first.