Six More Old CVEs Just Got Confirmed Exploited, One From 2008

Six more vulnerabilities entered CISA's Known Exploited Vulnerabilities catalogue in mid-to-late 2026 carrying disclosure dates from years — in one case, nearly two decades — earlier than their confirmation date. Together with the 2019 and 2023 CVEs covered in an earlier post on this pattern, they make the same point from six more directions: a vulnerability's age is not evidence of its irrelevance.

The oldest one is the most instructive

CVE-2008-4128, a cross-site request forgery in the HTTP administration component of Cisco IOS on the 871 Integrated Services Router, is eighteen years old as of its 2026 KEV listing. Its CVSS score, 4.3, is genuinely low by current standards — but "low severity" and "not worth attention" are different claims, and this CVE's presence in KEV at all means CISA has confirmed it is, right now, being actively used against real targets, regardless of how modest the individual bug's impact ceiling is. A device running IOS from an era contemporaneous with this disclosure was very likely never going to receive a patch for it either, which raises the practical question directly: does anything in your environment still run hardware this old, reachable by anything that would attempt a CSRF against its admin interface?

Two Red Hat-adjacent bugs from 2015, confirmed together

CVE-2015-3246 and CVE-2015-5287 were both added to KEV on the same day, eleven years after their original 2015 disclosures. Neither is Red Hat's flagship product — libuser is a user-account management library, and ABRT is a crash-reporting tool — which is precisely the category of supporting infrastructure most likely to be present, forgotten, and unpatched on a long-lived Linux server that has otherwise been kept reasonably current on its primary application stack.

A 2021 deserialization bug and a 2021 router buffer overflow

CVE-2021-23758 is deserialization of untrusted data in the ajaxpro.2 .NET package — a library dependency risk, not a standalone application vulnerability, meaning any codebase that pulled in the package inherits the flaw regardless of how carefully the application's own code was written. CVE-2021-27137 is an unsafe strcpy in DD-WRT's UPnP/SSDP handling — a classic, decades-old vulnerability pattern (unbounded string copy) in consumer and prosumer router firmware that, like the MikroTik and Ubiquiti findings elsewhere in this year's KEV additions, reflects how much of the internet's edge infrastructure runs firmware maintained on a very different cadence than enterprise software.

What six recurrences of this pattern should change about how you work

Build a recurring process that re-checks your full inventory against the entire KEV catalogue, not just new additions. A CVE from 2008, 2015, or 2021 entering KEV this year will never surface through a workflow that only evaluates newly disclosed vulnerabilities against current systems.

Pay particular attention to supporting libraries and infrastructure tools, not just primary applications. libuser, ABRT, and ajaxpro.2 are exactly the category of dependency that receives the least ongoing security attention precisely because nobody thinks of them as "the application."

Audit for genuinely old hardware and firmware specifically — DD-WRT and the eighteen-year-old Cisco IOS finding both point to the same category: edge devices running firmware nobody has revisited since installation, which is a different and often harder problem than patching software that receives regular updates.

How Safeguard helps

Safeguard's continuous inventory does not treat a component's age as a reason to check it less often — a dependency from 2008 or 2015 is evaluated against the current KEV catalogue with the same rigor as one from this year, which is precisely the gap that let six different vulnerabilities, spanning eighteen years of original disclosure dates, all surface as confirmed-exploited within the same few months of 2026.