CISA Just Set a September 12 Patch Deadline. Your Cisco, Citrix, or Fortinet Device May Be on the List.

Three vendors. Three actively exploited vulnerabilities. One federal deadline that most organizations are watching from the sidelines.

On September 10, 2026, CISA updated its Known Exploited Vulnerabilities catalog with three critical flaws affecting Cisco Secure Firewall Management Center, Citrix NetScaler ADC and Gateway, and Fortinet. Federal agencies have until September 12 to patch. That deadline is two days away from publication of this article.

Private organizations are not subject to the deadline. But the three products are standard enterprise network infrastructure, and the exploits are live.

The Three Vulnerabilities

CVE-2026-20079 — Cisco Secure Firewall Management Center. CVSS 10.0. An unauthenticated remote attacker can exploit an authentication bypass in the Cisco FMC web interface to gain root-level access. No credentials required. No user interaction needed. The FMC is the centralized management console for Cisco Firepower firewalls — the device that controls the rules governing what traffic is permitted or blocked across the entire managed firewall estate. An attacker with root access to the FMC can modify firewall policies, disable security controls, create unauthorized access rules, and gain full visibility into network traffic flows across all managed firewalls. CISA confirmed active exploitation in the wild.

CVE-2026-19490 — Citrix NetScaler ADC and NetScaler Gateway. CVSS 9.3. Authentication bypass allowing an unauthenticated attacker to access the management interface without valid credentials. NetScaler Gateway is widely deployed as the remote access and VPN layer for enterprise environments. Exploitation can allow policy modification, traffic interception, and use of the gateway as a pivot point into the internal network. Citrix products have been a persistent target for nation-state and criminal actors over the past four years — this vulnerability fits a well-established pattern of targeting the network access layer.

CVE-2025-25249 — Fortinet. CVSS 7.3. Heap-based buffer overflow. Fortinet has not disclosed full technical details, consistent with their responsible disclosure process. The lower CVSS score relative to the other two does not change the urgency: CISA's KEV listing confirms active exploitation, and a 7.3 on KEV is more operationally dangerous than a 9.8 that has no known exploit code.

Why the KEV Catalog Changes Patch Prioritization

The standard enterprise patch management model works roughly like this: scan for vulnerabilities, score by CVSS, categorize as critical or high, assign a remediation SLA, track completion. Critical is 30 days. High is 60 days. The higher the CVSS score, the faster the patch.

The problem is that CVSS measures theoretical severity, not exploitation reality. A vulnerability with a CVSS 10.0 that has no public exploit code and no observed exploitation in the wild is not the same threat as a CVSS 7.3 that criminal groups are actively using in ransomware campaigns. CVSS does not capture that distinction. The KEV catalog does.

CISA adds a vulnerability to KEV only when there is credible evidence of active exploitation in the wild — not just proof-of-concept code, not just published advisories, but actual observed attacks. The catalog reflects what attackers are using right now, not what they could theoretically use. That signal is more operationally valuable for prioritization than any CVSS score.

The Fortinet vulnerability in this batch illustrates the point. A CVSS 7.3 under a standard model might be scheduled for the 60-day high-severity track. On KEV, it belongs on your fastest remediation track because someone is actively exploiting it. The score does not tell you that. CISA does.

What Your Patch Program Needs to Change

Subscribe to KEV updates and route them to your vulnerability management team within 24 hours. CISA publishes KEV updates at cisa.gov/known-exploited-vulnerabilities-catalog. The catalog is also available via API for organizations that want to integrate it into their vulnerability management platform. Set up monitoring so that new additions trigger an immediate internal check against your asset inventory — not a weekly scan cycle, not a next-sprint ticket. A same-day impact assessment.

Establish a KEV-specific patch track with a faster SLA than your standard critical vulnerability process. A reasonable target for most organizations is 7 to 14 days for KEV entries. Some environments may need longer based on change management constraints. But your standard 30-day critical SLA is almost certainly too slow for actively exploited vulnerabilities. The attacker is not waiting 30 days.

For this specific batch: prioritize the Cisco FMC first. CVSS 10.0, auth bypass, root access, remote exploitation, no credentials — Cisco FMC access gives an attacker control over your entire managed firewall policy. If you run Cisco Firepower managed through FMC, this is your highest-priority remediation this week. Check for vendor patches and apply them. If no patch is yet available, restrict FMC management interface access to specific administrative source IPs and verify that internet-facing exposure is eliminated.

Check your Citrix NetScaler exposure. The NetScaler Gateway auth bypass continues a pattern of Citrix edge device targeting that has produced significant breaches over the past several years. If you run NetScaler Gateway as your remote access layer, confirm your patch status and verify that the management interface is not internet-exposed. Citrix patch advisories are published at support.citrix.com.