[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzKaYBA8SEipKa7u-SeR-_og_EqJxs71WlLnINrMoeQQ":3},{"article":4,"iocs":49,"watch_terms":64,"solutions":65,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"97c3a7db-18f7-462e-8c4e-73b9886ac047","CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline","cisa-flags-exploited-cisco-citrix-fortinet-flaws-sets-sept-12-federal-patch-dead-10251c","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below - CVE-2026-20079 (CVSS score: 10.0) - An authentication","CISA has added three critical vulnerabilities affecting Cisco, Citrix, and Fortinet products to its Known Exploited Vulnerabilities (KEV) catalog, mandating patches for Federal Civilian Executive Branch agencies by September 12, 2026. The flaws include an authentication bypass in Cisco Secure Firewall Management Center, an authentication bypass in Citrix NetScaler, and a heap-based buffer overflow in Fortinet FortiOS. Exploitation has been observed for all three, with Cisco noting active exploitation for its flaw in August 2026, Citrix seeing attempts on honeypots, and Fortinet's vulnerability linked to the PivotC2 RAT delivered by a Russian-speaking threat actor.","CISA adds three exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its KEV catalog.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcisa-flags-exploited-cisco-citrix.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh7j6Sm8OqDeYzrbb5faLBuDOc0zIMlvfjiKbn1aCMpx_2iBl6gb3HhJhpbqU8SPajHUClJEXUwnFbY1DcubmzWeVaWCyGcHkw45rCYqU_4IFO_g4OwdyNrTFFK3l3YsXwfOWQj2QtW3UTeglKmyRJ4GvbVKMxLTByMgeZ7E0WWpxpi50qie2lx9DbCY9rr\u002Fs1600\u002Fcisa-list.jpg","2026-09-10T10:36:46+00:00","2026-09-10T12:00:15.687543+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"Cisco","vendor",{"name":21,"type":19},"Citrix",{"name":23,"type":19},"Fortinet",{"name":25,"type":26},"Cisco Secure Firewall Management Center","product",{"name":28,"type":26},"Citrix NetScaler ADC",{"name":30,"type":26},"Citrix NetScaler Gateway","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,60],{"type":51,"value":52,"context":53},"cve","CVE-2026-20079","Cisco Secure Firewall Management Center authentication bypass vulnerability",{"type":51,"value":55,"context":56},"CVE-2026-19490","Citrix NetScaler ADC and NetScaler Gateway authentication bypass vulnerability",{"type":51,"value":58,"context":59},"CVE-2025-25249","Fortinet FortiOS, FortiSwitchManager, and FortiSASE heap-based buffer overflow vulnerability",{"type":61,"value":62,"context":63},"malware","PivotC2","Node.js remote access trojan suspected to be delivered via CVE-2025-25249",[18,21,23],{"controls":66,"vendors":149},[67,96,121],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":97,"product_name":118,"url":119,"description":120},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":48,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[150,155,159],{"slug":151,"name":18,"logo_path":152,"roles":153},"cisco","\u002Fvendor-logos\u002Fcisco.png",[154],"affected",{"slug":156,"name":21,"logo_path":157,"roles":158},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[154],{"slug":160,"name":23,"logo_path":161,"roles":162},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[154],{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":179},"critical-cisco-citrix-fortinet-flaws-actively-exploited-federal-patch-deadline-issued","Critical Cisco, Citrix & Fortinet Flaws Actively Exploited — Federal Patch Deadline Issued","Three critical vulnerabilities in widely deployed network and security infrastructure products — Cisco Secure Firewall Management Center, Citrix NetScaler, and Fortinet FortiOS — are being actively exploited in the wild, including by a Russian-speaking threat actor deploying the PivotC2 RAT. The flaws include authentication bypasses and a heap-based buffer overflow, all of which allow attackers to gain unauthorized access or execute arbitrary code on critical systems. CISA's addition to the Known Exploited Vulnerabilities (KEV) catalog underscores that these are not theoretical risks but confirmed, ongoing threats. Organizations that delay patching perimeter and security appliances are effectively leaving the front door unlocked, as these devices are often the first line of defense and directly internet-facing.",[168,169,170,171,172,173,174,175,176,177,178],"CIS Control 7 - Continuous Vulnerability Management","CIS Control 12 - Network Infrastructure Management","CIS Control 13 - Network Monitoring and Defense","NIST SP 800-40 Rev. 4 - Guide to Enterprise Patch Management Planning","NIST SI-2 - Flaw Remediation","NIST RA-5 - Vulnerability Monitoring and Scanning","NIST CM-6 - Configuration Settings","NIST AC-17 - Remote Access","CISA BOD 22-01 - Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL 4 - Change Enablement (emergency change process)","ISO\u002FIEC 27001:2022 - Control 8.8 Management of Technical Vulnerabilities",{}]