CISA Sets September 12 Deadline for Critical Cisco, Citrix and Fortinet Flaws

Introduction

The US Cybersecurity and Infrastructure Security Agency (CISA) added critical, actively exploited vulnerabilities in Cisco Secure Firewall Management Center, Citrix NetScaler ADC and Gateway, and Fortinet FortiOS and related products to its Known Exploited Vulnerabilities (KEV) catalog in early September 2026, setting a September 12, 2026 remediation deadline for US Federal Civilian Executive Branch agencies. On 9 September 2026, CISA formally added four vulnerabilities to the KEV catalog based on documented evidence of active exploitation. These are core perimeter security products — firewalls, application delivery controllers, and remote-access gateways — deployed across banking, telecom, healthcare, and government networks worldwide, which is what turns a federal compliance deadline into a practical must-patch advisory for any enterprise security team, regardless of jurisdiction.

The Four Vulnerabilities

Cisco Secure Firewall Management Center — CVE-2026-20079. An authentication bypass vulnerability in the product’s web interface, carrying the maximum possible CVSS score of 10.0. It could allow an unauthenticated, remote attacker to bypass authentication entirely and execute script files, ultimately gaining root access to the management platform that controls an organization’s firewall fleet. Active exploitation, including identified post-compromise activity clusters, was documented in August 2026.

Citrix NetScaler ADC and Gateway — CVE-2026-19490. An authentication bypass rated CVSS 9.3, affecting NetScaler appliances configured as AAA virtual servers or gateways — precisely the configuration used for VPN and remote-access authentication. Honeypot systems recorded 56 exploitation attempts against this vulnerability since early September 2026, indicating active, ongoing scanning and exploitation in the wild.

Fortinet FortiOS, FortiSwitchManager, and FortiSASE — CVE-2025-25249. A heap-based buffer overflow, CVSS 7.3, permitting a remote unauthenticated attacker to execute arbitrary code or commands. This flaw has been weaponized as part of the PivotC2 malware campaign, which CISA and independent researchers report has infected approximately 178 devices, with the earliest identified exploitation dating back to July 2026.

Google Chromium V8 — CVE-2026-87491. An out-of-bounds write vulnerability in Chromium’s V8 JavaScript engine, the fourth vulnerability added to the KEV catalog in the same 9 September update, extending the advisory’s relevance from network perimeter appliances to browser-based attack surfaces as well.

Why This Advisory Matters Beyond Federal Agencies

CISA’s KEV catalog additions and Binding Operational Directive (BOD) mandates legally apply only to US Federal Civilian Executive Branch agencies. But the KEV catalog functions, in practice, as a global de facto standard for “vulnerabilities attackers are actually using right now” — as distinct from the much larger universe of theoretical or low-severity CVEs that rarely see real-world exploitation. CISA’s own guidance encourages all organizations, not just federal agencies, to adopt the same risk-based prioritization the KEV catalog represents.

The specific products affected here compound the urgency. Cisco Secure Firewall Management Center, Citrix NetScaler, and FortiOS collectively sit at the network perimeter of an enormous share of global enterprise and government infrastructure — precisely the layer an attacker targets first when trying to establish an initial foothold from the open internet. A CVSS 10.0 authentication bypass on a firewall management platform is about as severe as a vulnerability disclosure gets, because it does not just expose one system — it can expose control over the security tooling meant to protect everything behind it.

What Security Teams Should Do Now

The practical response mirrors what CISA mandates for federal agencies, adjusted for organizations without a legal BOD deadline: identify whether any of the four affected products are in use (Cisco Secure Firewall Management Center, Citrix NetScaler ADC/Gateway, Fortinet FortiOS/FortiSwitchManager/FortiSASE, or Chromium-based browsers); apply vendor patches immediately for internet-facing instances, treating this as an emergency change rather than a routine patch cycle; and, where patching cannot happen immediately, restrict management-interface access to trusted networks only and monitor for the indicators of compromise vendors and CISA have published alongside the advisories. Given the PivotC2 campaign’s documented 178 infected devices and the 56 recorded NetScaler exploitation attempts against honeypots, organizations running unpatched instances of these products should assume active scanning against their infrastructure is already underway, not a future risk.

Frequently Asked Questions

Sources & Further Reading

• CISA Flags Exploited Cisco, Citrix, Fortinet Flaws — The Hacker News
• CISA Adds Four Known Exploited Vulnerabilities to Catalog — CISA