Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below - CVE-2026-20079 (CVSS score: 10.0) - An authentication
Analysis Summary
Below is the technical summary of the three vulnerabilities recently added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
---
# Vulnerability: Cisco FMC Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-20079
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Improper Authentication / Authentication Bypass
## Affected Systems
- **Products:** Cisco Secure Firewall Management Center (FMC) Software
- **Versions:** On-premises deployments (refer to Cisco advisory for specific version strings)
- **Configurations:** Web-based management interface enabled
## Vulnerability Description
A critical flaw in the web interface of Cisco FMC allows a remote, unauthenticated attacker to bypass authentication. By sending crafted requests to the interface, an attacker can execute arbitrary script files on the device, eventually gaining **root access** to the underlying operating system.
## Exploitation
- **Status:** Exploited in the wild (Observed in August 2026)
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Total
- **Integrity:** Total
- **Availability:** Total
## Remediation
- **Patches:** Apply updates provided in Cisco Security Advisory `cisco-sa-onprem-fmc-authbypass-5JPp45V2`.
- **Workarounds:** No specific workarounds listed; software update is required.
---
# Vulnerability: Citrix NetScaler Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-19490
- **CVSS Score:** 9.3 (Critical)
- **CWE:** Authentication Bypass
## Affected Systems
- **Products:** Citrix NetScaler ADC and NetScaler Gateway
- **Versions:** Specific versions of NetScaler ADC and Gateway
- **Configurations:** Systems configured as an **AAA virtual server** or as a **Gateway** (SSL VPN, ICA Proxy, CVPN, or RDP Proxy).
## Vulnerability Description
This flaw allows an attacker to bypass authentication requirements on NetScaler appliances. The vulnerability resides in the way the system handles authentication requests when acting as a gateway or authentication server, potentially leading to unauthorized access to internal resources.
## Exploitation
- **Status:** Exploited in the wild (Active targeting of honeypots observed in Sept 2026)
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
## Remediation
- **Patches:** Upgrade to the latest fixed versions of NetScaler ADC and NetScaler Gateway.
- **Workarounds:** Restrict access to the Gateway/AAA virtual servers to trusted IP ranges if immediate patching is not possible.
---
# Vulnerability: Fortinet FortiOS Heap-Based Buffer Overflow
## CVE Details
- **CVE ID:** CVE-2025-25249
- **CVSS Score:** 7.3 (High)
- **CWE:** CWE-122 (Heap-based Buffer Overflow)
## Affected Systems
- **Products:** Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- **Versions:** Refer to FortiGuard advisory FG-IR-25-084
- **Configurations:** Default network-facing management/service ports
## Vulnerability Description
A heap-based buffer overflow exists in the processing of specifically crafted requests. An unauthenticated remote attacker can exploit this to execute arbitrary code or system commands on the target device.
## Exploitation
- **Status:** Exploited in the wild (Weaponized since July 2026)
- **PoC Available:** Effectively available via threat actor toolsets (PivotC2 RAT)
- **Complexity:** Low/Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
- **Note:** Used to deploy "PivotC2," a Node.js-based RAT for tunneling and credential harvesting.
## Remediation
- **Patches:** Follow instructions in FortiGuard advisory `fortiguard[.]fortinet[.]com/psirt/FG-IR-25-084`.
- **Workarounds:** Disable unused services and implement strict firewall policies for management interfaces.
---
## Detection & Mitigation Strategies (General)
- **CISA KEV Requirement:** All FCEB agencies must apply patches for these vulnerabilities by **September 12, 2026**.
- **Indicators of Compromise (IoC):**
- Monitor for unusual outbound TLS connections to unknown C2 servers (associated with PivotC2).
- Check logs for unauthorized root-level script execution on Cisco FMC.
- Review NetScaler AAA logs for unusual authentication bypass attempts.
- **Tools:** Utilize vulnerability scanners (Tenable, Qualys, etc.) with updated plugins for these specific CVEs.
## References
- CISA KEV Catalog: `www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog`
- Cisco Advisory: `sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2`
- Fortinet PSIRT: `fortiguard[.]fortinet[.]com/psirt/FG-IR-25-084`
- Previdian Threat Research: `previdian[.]com/CVE-2026-19490`