CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.
CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center authentication bypass, CVSS 10.0), CVE-2026-19490 (Citrix NetScaler ADC/Gateway authentication bypass, CVSS 9.3), and CVE-2025-25249 (FortiOS heap buffer overflow, CVSS 7.3) to the Known Exploited Vulnerabilities catalog with a September 12, 2026 deadline for FCEB agencies. Cisco confirmed active exploitation of CVE-2026-20079 in August 2026, while Previdian honeypots logged 56 NetScaler exploitation attempts since September 3. SOCRadar attributes Fortinet exploitation to a financially motivated Russian-speaking actor deploying the PivotC2 Node.js RAT, infecting 178 of over 3,000 targeted IP addresses, mostly in the US.
Actively exploited Citrix NetScaler flaw CVE-2026-8452, patched in June, now added to CISA KEV; attackers deploy web shells and run discovery commands.
CISA added CVE-2026-8452, a memory overflow vulnerability in Citrix NetScaler ADC/Gateway, to its Known Exploited Vulnerabilities catalog on August 26, 2026, giving federal agencies until August 29 to remediate. Citrix disclosed and patched the flaw on June 30, 2026 in versions 14.1-72.61, 13.1-63.18, and 13.1-37.272. watchTowr Labs found the flaw can be chained into unauthenticated remote code execution and released a PoC on August 14. Previdian and Defused reported exploitation with web shells named x.php and z.php from at least three unique source IPs.
Authentication bypass to root access in Cisco Secure Firewall Management Center
CVE-2026-20079 is an authentication bypass (CWE-288) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, caused by an improper system process created at boot time. An unauthenticated, remote attacker can exploit it by sending crafted HTTP requests to the FMC web interface, which allows the execution of script files and commands on the device. A successful exploit grants the attacker root access to the underlying operating system, giving full control of the management platform (CVSS 3.1: 10.0, network-exploitable, no privileges or user interaction required, scope changed). The flaw affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management deployments. Cisco has confirmed the vulnerability is being exploited in active attacks, it carries a 35.9% EPSS score (98th percentile), and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.
Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.
· Fortinet FortiOS · Fortinet FortiSwitchManager KEV PoC mass
Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
Ajax.NET Professional (distributed as the ajaxpro.2 package) is vulnerable to insecure deserialization (CWE-502): it deserializes arbitrary .NET classes supplied by the client without validating which types may be instantiated. Because AjaxPro exposes HTTP endpoints for browser-to-server AJAX calls, a remote, unauthenticated attacker can send a crafted serialized payload to any reachable AjaxPro endpoint and abuse .NET deserialization gadget chains to execute code on the server. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score of 9.8, network vector, no privileges or user interaction required). Any application running any version of ajaxpro.2 / Ajax.NET Professional is affected; the provided data specifies no fixed version, so defenders must rely on vendor guidance for patched releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, carries an EPSS 30-day exploitation probability of 83.6%, has public PoC code available, and Talos Intelligence reporting links it to the Chinese-speaking threat actor UAT-10147, which deploys the SPECTRE malware with an EDR bypass and a Linux rootkit in post-compromise operations.
· michaelschwarz (ajaxpro.2 project) ajaxpro.2 (package) All versions are vulnerable; no fixed version specified in the provided data · michaelschwarz Ajax.NET Professional All versions are vulnerable; no fixed version specified in the provided data KEV PoC ×2
Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).
· Citrix NetScaler ADC and NetScaler Gateway KEV PoC large
Remote Code Execution in Microsoft SQL Server 2016 and 2017
CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server caused by improper handling of the processing of internal functions (CWE-20, improper input validation). An attacker who can reach SQL Server over the network with low-privileged credentials can trigger the flawed code path and execute arbitrary code, gaining high confidentiality, integrity, and availability impact on the database host. Any organization running affected Microsoft SQL Server versions — including SQL Server 2016 and SQL Server 2017 — is affected. The flaw carries a high EPSS score (52.8% probability of exploitation within 30 days, 99th percentile) and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, with headlines reporting it being exploited in active attacks. No public proof-of-concept is known, but the in-the-wild exploitation documented by CISA makes patching urgent; the fix shipped in Microsoft's July 2019 Patch Tuesday security updates.
· Microsoft SQL Server · microsoft SQL Server 2016 KEVmass
Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild
CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed.
Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
CVE-2022-0995 is an out-of-bounds (OOB) memory write in the Linux kernel's watch_queue event notification subsystem (CWE-787) that can overwrite parts of kernel state. A local user can trigger it through the watch_queue interface, for example by supplying a crafted event filter definition, causing the kernel to write beyond allocated memory when event notifications are processed. Successful exploitation may allow the local user to gain privileged (kernel/root) access or crash the system, yielding high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector). Affected systems include mainstream Linux kernels (Fedora is explicitly listed) and NetApp HCI appliance firmware products that ship the affected kernel. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, two public proof-of-concepts are available, and EPSS puts 30-day exploitation probability at 9.5% (95th percentile), though ransomware use is unconfirmed.
· Linux kernel Kernels shipping the watch_queue event notification subsystem prior to patched/upstream fixes (see distribution advisories for exact affected and fixed versions · Fedora Project Fedora Fedora releases with affected kernel packages prior to the issued kernel updates (see Fedora/Red Hat advisories) KEV PoC ×2mass
Race Condition in Red Hat libuser Allows Local Privilege Escalation
CVE-2015-3246 is a race condition in Red Hat's libuser, the user-management library used by utilities that modify system accounts, that can cause corruption of the /etc/passwd file during concurrent account updates. An authenticated local user who triggers the race — typically by racing account-modification operations against one another — can desynchronize or corrupt the passwd file. Successful exploitation yields either a denial-of-service condition on the host or, in the privilege-escalation case, elevated (root-level) access by manipulating entries in /etc/passwd. Any Red Hat system shipping the vulnerable libuser library is affected, with risk concentrated on multi-user servers where untrusted local accounts exist. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, indicating it is being exploited in the wild, and EPSS assigns it an 8.8% probability of exploitation within 30 days (95th percentile); ransomware use is unknown and no public proof-of-concept is cataloged.
· Red Hat libuser Affected versions not enumerated in the source data; applies to libuser as shipped with Red Hat distributions and remediated via Red Hat security updates KEVmass
Local Privilege Escalation via Symlink Attack in Red Hat ABRT
CVE-2015-5287 is a privilege escalation flaw in Red Hat's Automatic Bug Reporting Tool (ABRT) in which a local user with certain permissions can gain elevated privileges via a symlink attack against a file with a predictable name. Exploitation requires local access to an affected system; an attacker who triggers the flawed file-handling behavior can elevate their privileges on that machine. It affects deployments running ABRT, which ships by default with Red Hat Enterprise Linux and related distributions, including systems that may now be end-of-life or end-of-service. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-26, indicating exploitation has been observed in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS estimates a 5.0% probability of exploitation within 30 days (92nd percentile).
· Red Hat Automatic Bug Reporting Tool (ABRT) KEVmass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.