CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.
CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center authentication bypass, CVSS 10.0), CVE-2026-19490 (Citrix NetScaler ADC/Gateway authentication bypass, CVSS 9.3), and CVE-2025-25249 (FortiOS heap buffer overflow, CVSS 7.3) to the Known Exploited Vulnerabilities catalog with a September 12, 2026 deadline for FCEB agencies. Cisco confirmed active exploitation of CVE-2026-20079 in August 2026, while Previdian honeypots logged 56 NetScaler exploitation attempts since September 3. SOCRadar attributes Fortinet exploitation to a financially motivated Russian-speaking actor deploying the PivotC2 Node.js RAT, infecting 178 of over 3,000 targeted IP addresses, mostly in the US.
- CISA added three flaws to KEV with a September 12, 2026 federal patch deadline
- Cisco FMC CVE-2026-20079 (CVSS 10.0) allows unauthenticated root access; exploited in August 2026
- Citrix NetScaler bypass saw 56 honeypot exploitation attempts since September 3
- Fortinet CVE-2025-25249 used to deploy PivotC2 Node.js RAT on 178 devices, mostly US
- SOCRadar urges patching, IOC hunting, credential rotation, and limiting internet exposure
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.004 Unix ShellT1059.007 JavaScript/JScriptT1573 Encrypted Channel
- Products
- Cisco Secure Firewall Management CenterNetScaler ADCNetScaler GatewayFortiOSFortiSwitchManagerFortiSASEFortiGate
- Threat actors
- Fire Ant
- Malware
- PivotC2
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-25249 | Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE | 9.8 | 4% | KEVPoC | KEV |
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
From the original article
3 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.