CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 9, 2026, covering Cisco Secure Firewall Management Center, Citrix NetScaler, Google Chromium V8 and multiple Fortinet products. The four vulnerabilities are CVE-2026-20079, CVE-2026-19490, CVE-2026-87491 and CVE-2025-25249. Their inclusion in KEV means CISA has evidence that attackers have moved beyond theoretical exploitation and are using these weaknesses in real environments. That single fact should move all four sharply upward in remediation priority, regardless of whether a vulnerability scanner happens to place another technically higher-scoring CVE above them. 

Three of these vulnerabilities are particularly noteworthy because they affect infrastructure positioned at or near the enterprise security perimeter. Cisco FMC manages firewall policy, Citrix NetScaler frequently provides remote access and application-delivery services, and FortiOS powers devices that commonly function as enterprise firewalls and VPN gateways. Successful exploitation therefore does not merely compromise another application server. It can place attackers directly inside infrastructure possessing broad network visibility, privileged credentials and trusted access to internal systems.

CVE-2026-20079: Cisco FMC Authentication Bypass Can Lead Directly to Root 

CVE-2026-20079 is the most severe of the four from a conventional scoring perspective, carrying a CVSS score of 10.0. The vulnerability affects Cisco Secure Firewall Management Center and allows an unauthenticated remote attacker to bypass authentication through crafted HTTP requests, execute scripts and commands, and obtain root access to the underlying operating system. Cisco says the flaw results from an improper system process created during boot and that there is no workaround capable of fully addressing it.

The significance of root access to FMC extends far beyond the appliance itself. FMC exists specifically to manage security devices and policies across the network. It understands firewall rules, network objects, managed devices, topology, VPN relationships and administrative accounts. A successful attacker therefore gains a privileged vantage point from which they can begin mapping the enterprise using information already assembled for legitimate security administration.

Cisco Talos’ September 9 investigation shows that this is not hypothetical. Talos has observed active exploitation of CVE-2026-20079 across multiple intrusion clusters. One threat cluster deployed a JSP web shell and malicious JAR-based command executor and then queried FMC databases to retrieve authentication information and credentials. Another cluster associated with tooling overlapping the Sandworm ecosystem deployed reverse shells, harvested device configurations and installed Cyclops Blink malware.

A third intrusion cluster is particularly important for enterprise defenders because Talos assessed it with high confidence as a ransomware operator whose tactics were consistent with Qilin affiliates. After obtaining access to FMC infrastructure, the attackers carried out Active Directory reconnaissance, harvested credentials, established SOCKS and reverse-SSH tunnels and eventually deployed ransomware to selected endpoints.

This is a textbook demonstration of why management-plane vulnerabilities deserve disproportionate attention. The attacker is not necessarily interested in destroying the firewall manager. They use it as a trusted bridge deeper into the organization.

CISA has given federal agencies until September 12 to address CVE-2026-20079, only three days after its KEV addition. That compressed deadline reflects the severity of the threat and the fact that exploitation is already well documented.

Organizations running Cisco FMC should therefore patch immediately and perform compromise assessment rather than treating the update as a normal maintenance operation. Talos has published indicators involving malicious JSP files, command executors, reverse-shell infrastructure and Cyclops Blink, along with Snort signatures for the vulnerabilities and related malware.

CVE-2026-19490: NetScaler Authentication Bypass Moves From Attempts to Confirmed KEV Status 

CVE-2026-19490 affects Citrix NetScaler ADC and NetScaler Gateway and carries a CVSS v4 score of 9.3. The flaw allows an unauthenticated attacker to bypass authentication through an alternate path when affected appliances are configured as Gateway or AAA virtual servers under specified conditions. Citrix has released fixed builds including NetScaler ADC and Gateway 14.1-73.32 and 13.1-63.21, along with corresponding FIPS and NDcPP releases. No workaround is available.

When Citrix originally disclosed the flaw on August 19, public researchers had not yet confirmed successful exploitation. That situation has now materially changed. CISA’s September 9 KEV addition means sufficient evidence exists for the vulnerability to be formally classified as exploited in the wild.

This evolution is worth emphasizing because security teams often make patching decisions based on the threat situation at initial disclosure. An administrator may have evaluated CVE-2026-19490 several weeks ago, determined that there was no confirmed exploitation at the time and scheduled the upgrade for a later maintenance window. KEV status invalidates that earlier assumption.

Vulnerability management therefore needs to be continuous rather than transactional. Risk changes after publication.

A CVE initially described as theoretically exploitable can become an actively exploited threat days or weeks later without anything changing in the vulnerable software itself.

The environment did not become more vulnerable.

The attacker population became more capable.

NetScaler devices are especially attractive targets because they often sit directly on the internet and terminate SSL VPN, remote-access or application-delivery sessions. Compromise can therefore expose authentication sessions, internal connectivity and potentially sensitive credentials. Organizations should not merely patch the appliance but review authentication and session activity from the period when it remained vulnerable.

CISA has assigned September 12 as the remediation deadline for federal agencies, again providing only three days.

CVE-2026-87491: Another Chrome V8 Zero-Day Demonstrates Why Browsers Remain High-Value Initial Access Targets 

CVE-2026-87491 is an out-of-bounds write vulnerability in Chrome’s V8 JavaScript and WebAssembly engine. Google says a remote attacker can trigger the vulnerability through a crafted HTML page and achieve arbitrary code execution inside Chrome’s sandbox. Google has explicitly confirmed that an exploit exists in the wild.

Google fixed the vulnerability in Chrome 153.0.8010.36 for Windows and Linux and 153.0.8010.37 for macOS, with the patched builds beginning rollout on September 8. The flaw represents the seventh Chrome zero-day exploited in the wild that Google has patched during 2026.

The sandbox limitation needs to be described accurately. CVE-2026-87491 provides code execution inside the browser sandbox rather than automatically providing full operating-system compromise. However, sandboxed execution can still serve as the first stage of a more complex exploit chain. Attackers can combine a browser vulnerability with a separate sandbox escape or privilege-escalation flaw to progress from a malicious webpage to broader endpoint control.

This is exactly why browser and local privilege-escalation vulnerabilities frequently appear together in sophisticated attacks. One flaw provides code execution through user interaction, while another converts that constrained foothold into administrative or SYSTEM privileges.

Browsers also increasingly function as identity platforms. Corporate email, SaaS applications, cloud consoles and document systems all maintain authenticated sessions inside Chrome or another Chromium-based browser. Even without immediate host-level compromise, successful browser exploitation can provide opportunities to target sensitive session material or browser-resident information.

CISA gives CVE-2026-87491 a longer remediation window than the three edge-device vulnerabilities, with federal agencies required to address it by September 23. That does not mean organizations should wait two weeks. Managed browser updates can usually be rolled out much faster than firmware upgrades on production security appliances, and active exploitation means acceleration is justified.

Enterprises should also remember that Chrome is not the only possible downstream concern whenever Chromium vulnerabilities emerge. Other Chromium-based products may inherit vulnerable V8 code depending on their release cycle, although organizations should verify each vendor’s specific affected versions rather than assuming universal exposure.

CVE-2025-25249: Fortinet Heap Overflow Now Confirmed as an Active Exploitation Path 

CVE-2025-25249 is a heap-based buffer overflow affecting Fortinet FortiOS, FortiSwitchManager and FortiSASE. The vulnerability can allow an attacker to execute unauthorized code or commands through specially crafted packets. Affected FortiOS branches include multiple versions of 7.6, 7.4, 7.2, 7.0 and 6.4, while FortiSwitchManager branches are also affected. Fortinet has released corrected versions including FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, as well as fixed FortiSwitchManager versions.

The CVSS scoring surrounding CVE-2025-25249 varies across vulnerability sources because different scoring data and revisions have been published, so the precise number is less useful here than the operational fact that CISA now classifies it as actively exploited.

More importantly, SOCRadar reported exploitation of CVE-2025-25249 to deploy a post-exploitation framework called PivotC2. According to its investigation, attackers used the vulnerability against Fortinet devices and then deployed a Node.js-based RAT designed specifically for post-compromise operations on FortiGate systems. PivotC2 reportedly supports interactive command execution, tunneling, network scanning and configuration harvesting.

This is precisely what defenders should expect after compromise of an edge-security device. The firewall itself is not necessarily the final objective. It provides a durable position from which attackers can discover internal systems, harvest network configuration and tunnel traffic deeper into the environment.

Configuration harvesting deserves particular attention because firewall configurations effectively contain a map of trusted relationships. Interfaces, routes, network objects, VPNs and policies tell attackers where important systems live and which paths are permitted between them. The compromised security device therefore becomes both an access point and an intelligence source.

CISA has set September 12 as the federal remediation deadline for CVE-2025-25249.

Organizations running affected Fortinet devices should patch promptly, but active exploitation means they should also examine configuration integrity, unexpected administrative accounts, unusual processes, new outbound connections and changes to routing, VPN or firewall policy.

The Common Pattern: Attackers Are Targeting the Security Perimeter Itself 

Taken together, the September 9 additions reveal a pattern more interesting than the individual CVEs. Three of the four vulnerabilities affect infrastructure commonly positioned at the edge of an enterprise. Cisco FMC manages firewall infrastructure. NetScaler provides gateway and remote-access capabilities. FortiOS runs enterprise firewall and VPN platforms. These systems are attractive precisely because defenders intentionally give them exceptional network visibility and privileges. 

An attacker who compromises a normal endpoint often needs to discover the internal network manually. An attacker who compromises the network-management or gateway layer may obtain that information immediately. 

Edge devices also frequently create a detection blind spot. Organizations deploy comprehensive EDR coverage across Windows and Linux servers but may have substantially less telemetry from network appliances. Traditional endpoint agents usually cannot be installed on proprietary firewall and gateway operating systems, giving attackers another reason to prefer these targets.

That means external logging is especially important. Authentication, configuration changes, administrative actions and system events from security appliances should be exported to independent logging infrastructure where an attacker with root access to the appliance cannot simply remove them.

Outbound traffic originating from these devices should also be monitored. Firewalls and VPN gateways normally communicate with relatively predictable services. A security appliance suddenly establishing reverse SSH connections, SOCKS tunnels or connections to unfamiliar C2 infrastructure should be highly visible.

The September 9 additions also demonstrate why patching a known exploited vulnerability is frequently only half the response. If exploitation is already occurring, organizations need to ask two separate questions. Is the system vulnerable now? And was it compromised before we fixed it? Patching answers the first. Compromise assessment answers the second. 

CISA’s BOD 26-04 language accompanying these KEV entries increasingly reinforces that distinction by including forensic triage requirements when high-risk vulnerabilities affect exposed assets. The government is effectively moving from “patch the CVE” toward “patch it and establish whether somebody used it first.”

This is particularly important for edge devices because post-exploitation persistence may survive beyond closure of the original vulnerability. Attackers can deploy web shells, modify configuration, create accounts or establish tunnels that no longer depend on the CVE once installed.

The CVSS scores across this batch also reinforce why exploit intelligence matters more than simple vulnerability rankings. The Google Chrome flaw is not the highest-scoring vulnerability released this month. Fortinet scoring varies depending on the source. Citrix requires specific gateway or authentication configurations. Yet all four now have something many higher-scoring vulnerabilities do not. 

Evidence of exploitation.

That should be one of the strongest prioritization signals available to defenders. The September 9 KEV update therefore tells a broader story about where attackers are concentrating effort. They are targeting the browser that users trust to access applications. The VPN gateway that remote users trust to enter the enterprise. The firewall that controls network access. And the management platform that controls the firewall. 

Attackers are increasingly moving toward the systems that define trust rather than attacking every protected asset individually. That is strategically efficient. If you can compromise the gatekeeper, spending time climbing over the fence becomes unnecessary. And that is why these four vulnerabilities should be treated not merely as another group of CVEs requiring patches, but as evidence that the infrastructure enforcing enterprise trust has itself become one of the primary attack surfaces.

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerabili

Source: CISA Adds Four Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 09 Sep 2026.