CISA Orders Patches for Cisco, Citrix, Fortinet Flaws by Sept 12

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited security flaws to its Known Exploited Vulnerabilities (KEV) catalog, a public list of weaknesses that attackers are already using in real-world attacks. The affected products come from Cisco, Citrix, and Fortinet, all of which are common in enterprise networks. Federal Civilian Executive Branch agencies must apply patches for these flaws by September 12, 2026. The flaws affect network devices that sit at the edge of an organization's infrastructure, where they handle internet traffic, user logins, and remote access.

The first flaw, CVE-2026-20079, carries the highest possible CVSS score of 10.0. It is an authentication bypass vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software. An unauthenticated, remote attacker can bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Root access gives an attacker full control over the device. Cisco updated its advisory for this flaw to note that it became aware of active exploitation efforts targeting it in August 2026, but the company did not disclose additional details about the attacks.

The second flaw, CVE-2026-19490, has a CVSS score of 9.3. It is an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway when the appliance is configured as an AAA virtual server or as a Gateway for SSL VPN, ICA Proxy, CVPN, or RDP Proxy. This means attackers can get past login screens on these devices when certain remote access features are turned on. Security firm Previdian observed exploitation activity targeting its honeypot systems, recording a total of 56 attempts since September 3, 2026. Of those, 36 attempts were recorded on September 8, 2026, alone.

The third flaw, CVE-2025-25249, has a CVSS score of 7.3. It is a heap-based buffer overflow vulnerability in Fortinet FortiOS, FortiSwitchManager, and FortiSASE. A remote unauthenticated attacker can exploit this by sending specially crafted requests that let them execute arbitrary code or commands on the device. CISA added this flaw to the KEV catalog after SOCRadar published a report about a malicious attack campaign that is suspected to have weaponized the flaw to deliver a feature-rich Node.js remote access trojan (RAT) called PivotC2. The post-exploitation framework supports interactive shells, tunneling, network scanning, and configuration harvesting. SOCRadar estimates that more than 3,000 IP addresses were targeted, resulting in the infection of 178 devices with PivotC2. Most of the compromises are concentrated in the United States, and the activity is assessed to be the work of a Russian-speaking threat actor driven by financial gain. The earliest evidence of active exploitation of the flaw dates back to July 2026.

In the observed attacks, a shell script containing an exploit binary targets a vulnerable FortiGate instance to establish a reverse shell and run a single-line JavaScript command via Node.js. That leads to the download of a second-stage JavaScript payload, which is decrypted and executed to deliver PivotC2. SOCRadar described PivotC2 as establishing a persistent outbound TLS (Transport Layer Security) connection to a remote command-and-control (C2) server. Its feature set includes interactive shells, file transfers, SOCKS5/HTTP proxy tunneling, local and remote port forwarding, CIDR-range scanning, and FortiGate-specific configuration harvesting and credential decryption. An auto-mode flag enables autonomous operations, automatically running a predefined command sequence upon initial infection.

The Cisco addition also comes alongside a separate report from security company Sygnia, which said it observed a China-nexus cyber espionage group dubbed Fire Ant obtaining unauthorized access to Cisco IOS XR routers and abusing them to facilitate persistence, data collection, and deeper access into high-value networks via custom malware. Sygnia noted that this behavior shifts the router's role from a transit device to a collection platform, giving the attacker a vantage point for observing traffic moving through trusted network paths. Although this report concerns a different Cisco product line, it underscores the broader attention attackers are paying to network infrastructure.

These developments demonstrate that threat actors continuously scan exposed perimeter edge devices to obtain initial access, often taking advantage of a lack of robust monitoring or telemetry logging. For organizations using Fortinet products, SOCRadar recommends limiting internet access, hunting for indicators of compromise, rotating credentials, and applying the latest patches. For businesses that manage network appliances, AEU-I provides security-first IT and infrastructure consulting to support patch management and security monitoring.