CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA adds three exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its KEV catalog.
CISA has added three critical vulnerabilities affecting Cisco, Citrix, and Fortinet products to its Known Exploited Vulnerabilities (KEV) catalog, mandating patches for Federal Civilian Executive Branch agencies by September 12, 2026. The flaws include an authentication bypass in Cisco Secure Firewall Management Center, an authentication bypass in Citrix NetScaler, and a heap-based buffer overflow in Fortinet FortiOS. Exploitation has been observed for all three, with Cisco noting active exploitation for its flaw in August 2026, Citrix seeing attempts on honeypots, and Fortinet's vulnerability linked to the PivotC2 RAT delivered by a Russian-speaking threat actor.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco?
Get an email when a new story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThree critical vulnerabilities in widely deployed network and security infrastructure products — Cisco Secure Firewall Management Center, Citrix NetScaler, and Fortinet FortiOS — are being actively exploited in the wild, including by a Russian-speaking threat actor deploying the PivotC2 RAT. The flaws include authentication bypasses and a heap-based buffer overflow, all of which allow attackers to gain unauthorized access or execute arbitrary code on critical systems. CISA's addition to the Known Exploited Vulnerabilities (KEV) catalog underscores that these are not theoretical risks but confirmed, ongoing threats. Organizations that delay patching perimeter and security appliances are effectively leaving the front door unlocked, as these devices are often the first line of defense and directly internet-facing.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-20079
- cve — CVE-2026-19490
- cve — CVE-2025-25249
- malware — PivotC2