CISA has added four actively exploited vulnerabilities affecting Cisco firewall management, Citrix NetScaler, Fortinet network appliances, and Chromium’s V8 engine to its Known Exploited Vulnerabilities catalog. Three carry a September 12 federal remediation deadline, making exposed management systems the immediate priority; the Chrome deadline is September 23.
What changed
The September 9 catalog update adds CVE-2026-20079 in Cisco Secure Firewall Management Center and Secure Firewall Management Center in Security Cloud Control, CVE-2026-19490 in Citrix NetScaler ADC and Gateway, CVE-2025-25249 across several Fortinet product families, and CVE-2026-87491 in Chromium V8. CISA’s inclusion means it has evidence of exploitation in the wild, not merely a proof of concept.
Cisco also updated its advisory to say it observed exploitation of CVE-2026-20079 in August. The remotely reachable authentication bypass can give an attacker root privileges through the affected web interface. It has a CVSS score of 10.0, no workaround, and affects on-premises Firewall Management Center and the on-premises component of Security Cloud Control regardless of configuration. Cisco says its hosted Security Cloud Control service was fixed and requires no customer action.
The practical consequence
Operators should first inventory internet-reachable management planes, then compare installed releases and configurations with each vendor’s affected-product table. Cisco provides hot fixes and fixed releases; it also lists /var/tmp/license.tmp as an indicator of compromise and advises customers that suspect exploitation to contact its support organization. Installing a fix prevents future exploitation but does not establish that an already exposed system is clean.
Citrix says CVE-2026-19490 is an authentication bypass in customer-managed NetScaler deployments configured as a Gateway or AAA virtual server, including some SAML service-provider configurations. Supported 14.1 and 13.1 branches require the fixed builds in Citrix’s table. Citrix-managed cloud services have already been patched, and Citrix says there is no workaround for affected customer-managed appliances.
Fortinet describes CVE-2025-25249 as a heap-based buffer overflow that can permit code or command execution through crafted packets in affected FortiOS, FortiSwitchManager, and FortiSASE releases. Because affected and fixed versions vary by product branch, the advisory’s release matrix is safer than applying one version number across an estate.
Google fixed CVE-2026-87491, an out-of-bounds write in V8, in Chrome 153.0.8010.36 for Linux and 153.0.8010.36 or .37 for Windows and macOS. Google says an exploit exists in the wild. Managed fleets should verify that the browser has restarted into a fixed build; Chromium-derived browsers need their vendors’ corresponding updates.
Limits and evidence
CISA and the vendors do not publicly identify the attackers, campaign size, or victim count in these notices, and CISA lists ransomware use as unknown for all four entries. CISA confirms exploitation for each vulnerability, while Cisco and Google independently acknowledge observed exploitation for their respective flaws. The Citrix and Fortinet advisories describe exposure and remediation but do not document the active campaigns.
The V8 flaw can enable code execution within Chrome’s sandbox; the advisory does not claim that this vulnerability alone escapes the sandbox. Exposure also differs sharply by configuration: Citrix requires specified Gateway or AAA roles, while Cisco’s affected management products are vulnerable regardless of configuration. DrComps did not reproduce any exploit, and there are no performance benchmarks associated with these security fixes.