CISA Mandates Patching for Exploited Cisco, Citrix, and Fortinet Vulnerabilities
CISA has added three critical vulnerabilities affecting Cisco, Citrix, and Fortinet products to its Known Exploited Vulnerabilities catalog, demanding federal agencies apply patches by September 12, 2026.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added three significant vulnerabilities impacting widely-used network security products from Cisco, Citrix, and Fortinet to its Known Exploited Vulnerabilities (KEV) catalog. This directive mandates that all Federal Civilian Executive Branch (FCEB) agencies must implement available patches by September 12, 2026, to mitigate the risks associated with these actively exploited flaws.
The newly cataloged vulnerabilities include a critical authentication bypass flaw in Cisco Secure Firewall Management Center (FMC) Software (CVE-2026-20079), which carries a perfect CVSS score of 10.0. This vulnerability allows unauthenticated, remote attackers to bypass authentication mechanisms and gain root access to the device's operating system by executing script files. Cisco itself has confirmed awareness of active exploitation targeting this flaw since August 2026, though specific details remain undisclosed.
Citrix NetScaler ADC and NetScaler Gateway are affected by CVE-2026-19490, a high-severity (CVSS 9.3) authentication bypass vulnerability. This flaw specifically impacts configurations where the appliance is set up as an AAA virtual server or as a Gateway, including its SSL VPN, ICA Proxy, CVPN, or RDP Proxy functionalities. Exploitation activity has already been observed, with honeypot systems registering numerous attempts since early September, indicating active threat actor interest.
Fortinet products, including FortiOS, FortiSwitchManager, and FortiSASE, are impacted by CVE-2025-25249, a heap-based buffer overflow vulnerability with a CVSS score of 7.3. This flaw enables remote, unauthenticated attackers to execute arbitrary code or commands through specially crafted requests. Reports indicate that this vulnerability has been weaponized in a campaign suspected to be of Russian origin, targeting over 3,000 IP addresses and successfully deploying a feature-rich Node.js remote access trojan (RAT) known as PivotC2 on at least 178 devices, primarily in the U.S.
The PivotC2 RAT offers a comprehensive post-exploitation framework, supporting features such as interactive shells, tunneling, network scanning, and credential harvesting. It establishes persistent outbound TLS connections to command-and-control (C2) servers and can operate autonomously. The observed attacks typically involve an exploit binary that establishes a reverse shell on a vulnerable FortiGate instance, leading to the download and execution of the PivotC2 payload.
These additions to the KEV catalog underscore a persistent trend of threat actors actively scanning and exploiting vulnerabilities in internet-facing perimeter devices. The exploitation of these flaws highlights the critical need for organizations to maintain robust monitoring, timely patching, and vigilant threat hunting to defend against sophisticated attacks.
CISA's directive serves as a stark reminder of the ongoing cybersecurity threats and the importance of proactive security measures. Federal agencies are now under strict orders to address these vulnerabilities to prevent potential breaches and protect sensitive data.
This new report details the specific exploitation of CVE-2024-21762 against Triple T Broadband (3BB), revealing an attacker-controlled staging server with extensive tools and evidence of intrusion. The findings include specific reconnaissance scripts targeting the FortiGate appliance, deployment of MeshCentral for persistence, and attempts to exfiltrate sensitive data from internal systems, providing a deeper look into the campaign's tactics, techniques, and procedures.
CISA has now added CVE-2026-84869, a critical vulnerability affecting ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw allows unauthorized file transfer and execution during active sessions, enabling attackers to deliver payloads and further compromise networks. The agency has mandated remediation by September 14, 2026, and stressed the need for forensic triage beyond simple patching.