CISA KEV Deadline: Patch NetScaler and FortiOS Now

CISA doesn’t usually add four vulnerabilities to its Known Exploited Vulnerabilities catalog on the same day. On September 9, 2026, it did anyway: a Citrix NetScaler auth bypass, a Fortinet remote code execution bug, a Cisco Firewall Management Center auth bypass, and a Chromium V8 flaw. One of them, the Fortinet bug, comes with a hard deadline for federal agencies under Binding Operational Directive 26-04. Count three business days from September 9, and you land on today, September 12.

If you’re not a federal agency, that deadline doesn’t technically bind you. But CISA’s directive is a decent proxy for “how bad is this, really,” and the honest answer here is: bad enough that you shouldn’t wait for your next patch window.

What’s in the batch

CISA’s September 9, 2026 KEV addition covers four unrelated vulnerabilities under confirmed active exploitation: a Citrix NetScaler ADC/Gateway auth bypass (CVE-2026-19490, CVSS 9.3), a Fortinet FortiOS/FortiSwitchManager RCE (CVE-2025-25249, CVSS 9.8), a Cisco Firewall Management Center auth bypass (CVE-2026-20079, CVSS 10.0), and a Chromium V8 flaw (CVE-2026-87491). Here’s what actually matters about each one.

CVE	Product	CVSS	Status
CVE-2026-19490	Citrix NetScaler ADC/Gateway	9.3	Exploitation confirmed since early September
CVE-2025-25249	Fortinet FortiOS/FortiSwitchManager	9.8	Patched since January; still being exploited on unpatched boxes
CVE-2026-20079	Cisco Firewall Management Center	10.0	Actively exploited since August; we covered it in detail here
CVE-2026-87491	Chromium V8 (Chrome, Edge, other Chromium browsers)	Not yet scored	Fixed in the current stable channel; update your browser

The Cisco and Chromium bugs are worth a mention, not a deep dive here since one already has its own writeup and the other resolves itself the moment your browser auto-updates. The two that need your actual attention this week are the Citrix and Fortinet bugs, because both sit on infrastructure that doesn’t patch itself.

CVE-2026-19490: NetScaler’s auth bypass has real exploitation numbers now

Citrix disclosed CVE-2026-19490 back on August 19, 2026, a CVSS 9.3 authentication bypass affecting NetScaler ADC and Gateway when specific SAML, AAA, and Gateway virtual server configurations are in play. At the time, Rapid7 said plainly that it hadn’t seen evidence of exploitation. That’s no longer true.

Bishop Fox’s research lays out why this bug is nastier than a standard auth bypass: a single unauthenticated request causes the appliance to run its post-login code path, and what happens next depends entirely on how the box is configured. In the mild case, that’s a reliable pre-auth crash. In the bad case, it’s root on the appliance. Same request, wildly different blast radius, depending on settings most admins never audit after initial setup.

The exploitation numbers back up why CISA moved on this one. A honeypot network tracked by researchers logged 56 exploitation attempts since September 3, with 36 of those landing in a single day, September 8, right before the KEV addition. That’s not a slow trickle of curious scanning. That’s a spike.

Fixed versions: NetScaler ADC/Gateway 14.1-73.32 or later, 13.1-63.21 or later, with matching FIPS/NDcPP builds. If you’re running anything older on either branch and the appliance terminates SAML, AAA, or Gateway sessions, patch it today and then go audit exactly which of those features are actually enabled, because disabling ones you don’t use shrinks the blast radius even after patching.

This is the third notable NetScaler CVE we’ve written about this year. CVE-2026-8452 was a different pre-auth RCE bug entirely, not a variant of this one. Two unrelated critical bugs in the same product line in one year isn’t a coincidence about NetScaler specifically, it’s what happens to any internet-facing gateway appliance that enterprises can’t easily take offline to patch.

CVE-2025-25249: patched in January, still getting people breached in September

Here’s the part of this story that should worry you more than the NetScaler numbers: Fortinet shipped a fix for CVE-2025-25249 in January 2026, eight months before CISA added it to the KEV catalog. The bug itself is a heap-based buffer overflow in the cw_acd daemon, the process that handles CAPWAP requests on UDP port 5246, and it lets an unauthenticated remote attacker execute arbitrary code with a crafted request. No login required, no user interaction.

SOCRadar’s writeup documents the actual exploit chain attackers are using: a self-extracting Linux binary called fortirun.bin, paired with Bash and Python automation, fingerprints the target’s firmware and hardware, abuses CAPWAP discovery responses to defeat ASLR, grooms the daemon’s heap, corrupts linked-list pointers to get an arbitrary write, and hijacks execution to launch a Node.js reverse shell. From there, the attacker drops PivotC2, a purpose-built RAT that provides an interactive shell, tunnels traffic over SOCKS5 or HTTP so it blends into normal outbound HTTPS, scans the internal network from behind the firewall, and harvests device configuration and stored credentials.

The campaign scope is the number that should reframe how you think about “we’ll patch it eventually”: researchers tracked scanning against more than 30,000 internet-exposed FortiGate IP addresses, with 178 confirmed compromises, concentrated in the United States, running since at least July 2026. That’s not a handful of high-value targets. That’s a wide, automated sweep finding whatever didn’t get patched.

Affected: FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17, and all 6.4.x builds; FortiSwitchManager 7.2.0-7.2.6 and 7.0.0-7.0.5. Fixed in: FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18; FortiSwitchManager 7.2.7 or 7.0.6. Check your version against that list before you assume a January patch cycle already covered you. If it’s been eight months and you haven’t confirmed the version on every FortiGate and FortiSwitchManager instance you run, that’s the actual gap CISA’s KEV addition is telling you about, not a new zero-day.

If you find a box that’s still on a vulnerable build, treat it as potentially compromised, not just unpatched. Check for unexpected outbound SOCKS5 or HTTP tunnel traffic, look for processes you don’t recognize spawned by the management daemon, and rotate credentials stored on the device once you’ve confirmed clean.

Why one deadline covers such different bugs

BOD 26-04 doesn’t score every KEV entry the same way. It targets vulnerabilities in internet-facing management interfaces and network appliances specifically, the category where a successful exploit hands over “total control of the asset,” in CISA’s own language, and where the exposed population tends to be large and slow to patch. NetScaler, FortiOS, and Cisco FMC all fit that description exactly: they’re the boxes sitting at the network edge that everyone depends on and almost nobody wants to touch during business hours.

That’s the actual lesson from this batch, more than any individual CVE number. A patch that shipped in January doesn’t protect you in September if nobody applied it, and a bug disclosed three weeks ago can go from “no observed exploitation” to “56 attempts in a honeypot” faster than most patch-management cycles move. If your team manages infrastructure for clients and a recurring check of internet-facing management interfaces isn’t already part of that relationship, our security review process starts with exactly that question: what’s reachable from the internet, what version is it actually running, and how long has it been since anyone checked. Pair it with what we’ve written about the actual cost of getting a security incident wrong, because the FortiOS numbers here make the same point from the attacker’s side: 30,000 scanned, 178 caught, all because a patch sat unapplied.

Patch NetScaler and FortiOS this week if you haven’t. If you’re on either platform and can’t confirm your exact build number right now, that’s the first thing to fix, before you do anything else on today’s list.