// CISA
CISA Red Team Wake-Up Call: Detection Gaps and Six KEV Additions Demand Immediate Action
By NeoShield AI Threat Desk · Published 2026-08-27 · 5 min read
#CISA#Red Team#Critical Infrastructure#KEV#CVE-2021-23758#CVE-2015-3246#CVE-2015-5287#CVE-2022-0995
CISA's dual red team assessment reveals a stark detection divide between critical infrastructure organizations, while six newly catalogued exploited vulnerabilities — spanning Linux, Red Hat components, and Ajax.NET — signal active attacker interest in legacy and unpatched systems.
The CISA red team assessment story is the most instructive. CISA conducted simultaneous adversary simulation exercises against two critical infrastructure organizations using comparable tradecraft and attack techniques. The results were dramatically different: one organization detected and responded to the simulated intrusion, while the other recorded nothing — zero alerts, zero detections, zero awareness that a skilled team had moved through its environment. This is not a theoretical gap. It is a documented, real-world demonstration that two organizations operating in the same sector, facing the same threat model, can have wildly divergent security outcomes based almost entirely on the maturity of their detection and response capabilities. The organization that detected nothing did not necessarily have weaker perimeter controls; it had weaker visibility into what was happening inside its own network.
This finding should prompt every security leader to ask a direct question: if a red team operated in our environment for days or weeks using living-off-the-land techniques, lateral movement, and credential abuse, would we know? The honest answer for many organizations is uncertain at best.
Layered on top of this detection story is CISA's addition of six vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming that threat actors are actively leveraging these flaws in the wild. Four deserve particular attention.
CVE-2021-23758 affects Ajax.NET Professional, a library used to expose server-side .NET methods to client-side JavaScript. The vulnerability involves deserialization of untrusted data, a class of flaw that has repeatedly enabled remote code execution across the industry. If your web applications or internal tools use Ajax.NET Professional and have not been updated or replaced, this is an active exploitation risk, not a theoretical one.
CVE-2015-3246 is a race condition vulnerability in Red Hat Libuser, a library used for managing user and group account information on Linux systems. Despite being over a decade old, its presence in the KEV catalog means attackers are still finding and exploiting unpatched instances. Legacy Linux environments, long-running servers, and systems that have drifted from patch cycles are the likely targets.
CVE-2015-5287 affects the Red Hat Automatic Bug Reporting Tool and allows local privilege escalation. Again, the age of this vulnerability is striking. Its active exploitation suggests attackers are using it as a post-access escalation step — gaining a foothold through another means and then leveraging this flaw to elevate privileges on Red Hat-based systems.
CVE-2022-0995 is an out-of-bounds write vulnerability in the Linux kernel's watch queue subsystem. This is more recent and more broadly applicable across Linux distributions. Out-of-bounds write flaws in the kernel are serious because they can be chained with initial access techniques to achieve full system compromise. Any Linux system running a kernel version prior to the fix for this CVE should be treated as a priority patching target.
Defensive priorities for teams responding to today's briefing:
- Audit your detection coverage immediately. Use the CISA red team findings as a forcing function to evaluate whether your SIEM, EDR, and network monitoring tools would surface credential dumping, lateral movement via legitimate admin tools, and internal reconnaissance. If you cannot answer confidently, schedule a tabletop or purple team exercise.
- Cross-reference your asset inventory against all six KEV additions. Prioritize CVE-2022-0995 for Linux kernel patching across your server fleet, and hunt for any Ajax.NET Professional usage in web-facing or internal applications for CVE-2021-23758.
- For Red Hat environments, verify patch status against CVE-2015-3246 and CVE-2015-5287 on all RHEL-based systems, particularly those that have not been through a recent patch cycle. Legacy servers in OT-adjacent or air-gapped environments are especially at risk of carrying these old vulnerabilities.
- Implement or review alerting for local privilege escalation attempts on Linux hosts. Behavioral detections around unexpected setuid execution, unusual process ancestry, and kernel exploit indicators can surface exploitation attempts for both the Libuser and Linux kernel CVEs.
- Treat deserialization inputs as untrusted by default. For applications using Ajax.NET Professional or similar frameworks, review input validation controls and consider web application firewall rules that flag anomalous serialized data patterns.
- Review your incident response runbooks for critical infrastructure-specific scenarios. The CISA assessment underscores that detection alone is insufficient — the organization that detected the intrusion succeeded because it also had a practiced response process.
The convergence of a documented detection failure in critical infrastructure and six actively exploited vulnerabilities — some embarrassingly old — is a reminder that security debt compounds. Attackers are patient, and they are still finding success with tools and techniques that defenders have had years to address.
This briefing is informational and intended to support defensive awareness; always consult official vendor advisories and the CISA KEV catalog directly for authoritative remediation guidance.
Related articles
Iranian APTs, Gitea Zero-Day, and Supply Chain Abuse: August 26 Threat Briefing
A convergence of state-sponsored Iranian cyber operations, an actively exploited Gitea code injection flaw, and creative supply…
Oracle WebLogicIdentity Under Siege: Oracle, Keycloak, Zimbra, and WordPress Flaws Demand Immediate Action
A wave of critical authentication and access-control vulnerabilities is actively being exploited across enterprise identity…
CISA KEVActive Exploitation Surge: Zimbra, TrueConf, Android Botnets, and Poisoned npm Packages
August 24 brings a dense cluster of actively exploited vulnerabilities and evolving malware campaigns spanning enterprise…
NeoShield Security publishes defensive cybersecurity guides for developers, small teams, SOC learners, and MSPs. AI-assisted content is reviewed for safety, defensive purpose, and practical security value.