Skip to content
Today
Sections

Security Reports disagree4 publishers 2 min read Published Updated

A CVSS 10.0 Cisco FMC bypass tops the four flaws CISA moved into KEV

CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.

The Watch · Security desk

Send a correction

Illustration accompanying A CVSS 10.0 Cisco FMC bypass tops the four flaws CISA moved into KEV
Generated illustration

What happened

  • CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, covering Fortinet, Citrix NetScaler, Google Chromium V8 and Cisco Firewall Management Center, citing evidence of active exploitation.
  • Security Affairs reported that exploitation of the Fortinet heap overflow CVE-2025-25249 has included attacks deploying the PivotC2 remote access trojan onto compromised FortiGate devices.
  • The V8 out-of-bounds write CVE-2026-87491 runs arbitrary code inside Chrome's sandbox from a crafted HTML page and is fixed in Chrome 153.0.8010.36 and later.

Why it matters

  • Who's exposed exposure Three of the four sit on appliances an attacker can reach unprompted with no credentials, so the exposure does not depend on a user clicking anything or on a browser update cycle finishing.
  • What doesn't add up contradiction CISA's alert governs these four under BOD 26-04 with no date attached, while Security Affairs writes up the older BOD 22-01 and prints two dates, one of which belongs to Windows flaws absent from the list.
  • Who has to decide decision Under BOD 26-04 a federal patch queue ranks on whether the asset is publicly exposed and whether exploitation grants total control, which puts the FMC and NetScaler boxes ahead of the browser fleet.
  • What it limits constraint Patching is only half of what 26-04 asks: agencies also have to determine whether the system was compromised before the fix landed, and on an authentication bypass that means hunting without a failed-login trail.

The Cisco bug is the one to sequence first. CVE-2026-20079 sits in Secure FMC's web interface, and an unauthenticated remote attacker who can reach that interface sends crafted HTTP requests, executes scripts, and can end up with root on the underlying operating system [4]. CISA's catalog entry names the product Cisco Firewall Management Center [2].

Citrix's CVE-2026-19490 is an authentication bypass through the SAML HTTP-Redirect binding on NetScaler ADC and NetScaler Gateway, rated 8.1 lower at 9.3, and it also needs no credentials [3]. Fortinet's CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon in FortiOS and FortiSwitchManager, rated 8.1, reachable by crafted packets from an unauthenticated source [17]. Security Affairs reported that exploitation has included attacks deploying the PivotC2 remote access trojan on compromised FortiGate devices [7]. That CVE carries a 2025 identifier while the other three carry 2026 ones [14].

Three of the four are reachable without credentials [11]. The fourth needs a user to load a page: CVE-2026-87491 is an out-of-bounds write in V8 that executes arbitrary code inside Chrome's sandbox from a crafted HTML page, fixed in Chrome 153.0.8010.36 and later [5]. Google's advisory said "Google is aware that an exploit for CVE-2026-87491 exists in the wild." [6]. Security Affairs counted it as the seventh actively exploited Chrome zero-day of 2026 [18].

CISA's alert cites Binding Operational Directive 26-04, which requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, and to defer lower-risk work [8]. The alert sets no remediation date for any of the four [13]. Security Affairs cited the older BOD 22-01 and reported that CISA orders agencies to fix the Windows flaws by September 22, 2026, with the remaining ones due September 12, 2026 [15][16]. No Windows CVE appears among the four CISA listed [12].

So the date to plan against, for federal readers, is the one Security Affairs prints for the batch and CISA does not: September 12 [16][13]. Private-sector readers get no date at all. CISA says 26-04 binds FCEB agencies only, and encourages every other organization to prioritize KEV remediation [10].

BOD 26-04 also sets expectations for when agencies must check whether threat actors compromised a system before the patch went on [9]. For the FMC and NetScaler flaws that is the larger job, because both are authentication bypasses [4][3]. Under 26-04 the ranking criterion is total control of a publicly exposed asset after exploitation, and root on the FMC host meets it [4][8].

What to watch

  • Whether CISA publishes per-CVE remediation dates for these four under BOD 26-04, or leaves the timing to agency risk triage.
  • Whether PivotC2 activity on FortiGate devices is tied to a named actor or spreads to FortiSwitchManager deployments.
  • Whether the NetScaler SAML HTTP-Redirect bypass shows up in reported intrusions at named victims, and at what scale.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence72
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence70

Perspective Coverage

4 publishers
Builder
Builder 14%
Operator
Operator 80%
Investor
Investor 6%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2025-25249 (Fortinet multiple products heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass using an alternate path or channel), CVE-2026-87491 (Google Chromium V8 out of bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass using an alternate path or channel).

    Reported SupportedView cited source
  2. [2]

    CISA's catalog entry names the affected product Cisco Firewall Management Center.

    Reported SupportedView cited source
  3. [3]

    CVE-2026-19490 (CVSS score 9.3) is an authentication bypass affecting Citrix NetScaler ADC and NetScaler Gateway that allows unauthenticated remote attackers to bypass authentication through the SAML HTTP-Redirect binding, potentially gaining unauthorized access to protected services.

    Reported SupportedView cited source
  4. [4]

    CVE-2026-20079 (CVSS score 10.0) is an authentication bypass in Cisco Secure FMC's web interface that lets unauthenticated remote attackers bypass authentication and send crafted HTTP requests to execute scripts, potentially gaining root access to the underlying operating system.

    Reported SupportedView cited source
  5. [5]

    CVE-2026-87491 (CVSS score 8.8) is an out-of-bounds write in V8, Chrome's JavaScript and WebAssembly engine; an attacker can exploit it through a specially crafted HTML page to execute arbitrary code inside Chrome's sandbox, and Google fixed it in Chrome 153.0.8010.36 and later versions.

    Reported SupportedView cited source
  6. [6]

    "Google is aware that an exploit for CVE-2026-87491 exists in the wild."

    Reported Supported Source: Google advisory, as quoted by Security AffairsView cited source
  7. [7]

    CVE-2025-25249 is being actively exploited in the wild, including in attacks that deployed the PivotC2 remote access trojan on compromised FortiGate devices.

    Reported Supported Source: Security AffairsView cited source
  8. [8]

    Binding Operational Directive 26-04 requires FCEB agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically CVEs listed in CISA's KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities.

    Reported SupportedView cited source
  9. [9]

    BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

    Reported SupportedView cited source
  10. [10]

    CISA states that BOD 26-04 applies only to FCEB agencies and encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

    Reported SupportedView cited source
  11. [11]

    Three of the four newly listed flaws (Cisco Secure FMC, FortiOS/FortiSwitchManager, NetScaler ADC and Gateway) are exploitable by unauthenticated remote attackers, while the fourth requires a user to load a crafted HTML page.

    Derived Supported
  12. [12]

    None of the four CVEs CISA listed in this addition is a Microsoft Windows vulnerability, so the September 22, 2026 date Security Affairs attached to Windows flaws does not apply to this batch.

    Derived Supported
  13. [13]

    CISA's alert announcing the four additions states no remediation due date for any of the four CVEs; it references BOD 26-04's risk-based prioritization requirements instead.

    Derived Supported
  14. [14]

    The Fortinet flaw carries a 2025 CVE identifier (CVE-2025-25249) while the Cisco, Citrix and Chromium flaws carry 2026 identifiers.

    Derived Supported
  15. [15]

    Security Affairs cited Binding Operational Directive 22-01 and said FCEB agencies have to address the identified vulnerabilities by the due date.

    Reported Contested Source: Security AffairsView cited source
  16. [16]

    CISA orders federal agencies to fix the Windows flaws by September 22, 2026, while the remaining must be addressed by September 12, 2026.

    Reported Contested Source: Security AffairsView cited source
  17. [17]

    CVE-2025-25249 (CVSS score 8.1) is a heap-based buffer overflow in Fortinet FortiOS and FortiSwitchManager, residing in the cw_acd daemon, allowing unauthenticated remote attackers to execute arbitrary code or commands by sending specially crafted packets.

    Reported ContestedView cited source
  18. [18]

    CVE-2026-87491 is the seventh actively exploited Chrome zero-day of 2026.

    Reported Insufficient Source: Security AffairsView cited source

Sources

4 independent publishers whose own reporting we read for this story.

  1. cisa.gov

    1 article · September 9, 2026

    CISA Adds Four Known Exploited Vulnerabilities to Catalog
  2. securityaffairs.com

    1 article · September 10, 2026

    U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
  3. securityweek.com

    1 article · September 10, 2026

    Critical NetScaler Vulnerability Exploited in Attacks
  4. thehackernews.com

    1 article · September 10, 2026

    CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

Topics and entities

Topics

Entities