CISA KEV Update September 9 2026

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on September 9, 2026: CVE-2026-19490 in Citrix NetScaler ADC and NetScaler Gateway, CVE-2025-25249 in Fortinet FortiOS, FortiSwitchManager and FortiSASE, CVE-2026-20079 in Cisco Secure Firewall Management Center and Security Cloud Control Firewall Management, and CVE-2026-87491 in Chromium V8. The NetScaler flaw is a CWE-288 authentication bypass at CVSS v4 9.3 that applies when the appliance runs as an AAA virtual server or as a Gateway doing SSL VPN, ICA Proxy, CVPN or RDP Proxy, with a SAML action required on builds 14.1-43.56 and 13.1-61.28 or later. The Fortinet flaw is a heap-based buffer overflow in the cw_acd daemon that turns crafted CAPWAP packets into unauthenticated code execution, scored 7.4 by Fortinet. The Cisco flaw is a web interface authentication bypass at CVSS 10.0 caused by an improper system process created at boot time, and a successful exploit executes scripts with root on the FMC. The V8 flaw is an out of bounds write rated Medium that runs arbitrary code inside the renderer sandbox from a crafted HTML page, and Google confirmed an exploit exists in the wild when it shipped the fix in Chrome 153.0.8010.36 and .37 on September 8.

Set each listing date against its fix date and the catalog is a lagging indicator, not an early warning. Cisco published the FMC fix on March 4, 2026, and its PSIRT acknowledged active exploitation in an August 2026 revision, six months during which patched products were being attacked. Fortinet published the cw_acd fix on January 13, and SOCRadar places the start of the PivotC2 campaign no later than July, with more than 30,000 FortiGate IPs targeted and 178 confirmed infections concentrated in the United States. Citrix shipped 14.1-73.32 and 13.1-63.21 on August 19 stating no observed exploitation, and on September 3 Previdian sensors logged requests matching a public proof of concept from source IPs in Australia, the United States and Germany. None of that history is visible in the KEV rows, which is the argument: a KEV feed alone cannot drive patch timing, because by the time an entry lands, months of exploitation may already sit behind it. What makes this batch worth singling out is composition rather than novelty, since two of the four are pre-auth bypasses on internet-facing gateway and management planes that end in root, and the third is a browser bug with a working exploit already paired to it; BOD 26-04 now puts federal civilian agencies on a September 12 due date for those three and September 23 for the browser bug.

The remediation targets are exact. Upgrade NetScaler ADC and Gateway to 14.1-73.32 or 13.1-63.21, 14.1-73.32 FIPS or 13.1-37.277 for FIPS and NDcPP builds, and first inspect configs for "add authentication samlAction", "add vpn vserver" and "add authentication vserver" to learn which appliances meet the preconditions. Upgrade FMC to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0, then run zgrep "package_info.license" against /var/log/messages in expert mode and treat any record of /var/tmp/license.tmp executed by the www user as root as evidence of compromise, contacting Cisco TAC, since Cisco states the fixes prevent future exploitation only and there are no workarounds beyond keeping the management interface off the internet. Upgrade FortiOS to 7.6.4, 7.4.9, 7.2.12 or 7.0.18 and FortiSwitchManager to 7.2.7 or 7.0.6, remove fabric from interface allowaccess where CAPWAP is not needed, and add local-in policies blocking CAPWAP-CONTROL on UDP 5246 through 5249 from everything except management subnets, then hunt for the fortirun.bin dropper on any appliance that faced the internet. Chrome 153.0.8010.36/.37 should reach managed fleets through normal update channels, with Edge and Opera inheriting the V8 fix on their own release cadence.

Two developments would change this assessment. CISA marks ransomware use as Unknown on all four entries and requires forensic triage on the three infrastructure bugs but not the browser bug, so a ransomware association, most plausibly on the FMC root bug that already has named exploit tooling, would convert a patching task into an incident response trigger. Vendor revision is the other: Fortinet's page still lists Known Exploited as No while SOCRadar attributes 178 infections to the bug, and Cisco's exploitation acknowledgment arrived in a revision after the KEV listing, so the next advisory updates from either vendor are the signal that triage priorities need rework.