CISA Flags Critical Vulnerabilities in Cisco, Google, Fortinet, and Citrix Products
U.S. cybersecurity agency warns of actively exploited flaws in major tech platforms.
1CISA's KEV Catalog Update
The U.S. Cybersecurity and Infrastructure Security Agency added five critical vulnerabilities from Cisco, Google, Fortinet, and Citrix to its Known Exploited Vulnerabilities catalog. These flaws are being actively exploited in the wild, posing significant risks to federal networks and private organizations. The catalog helps prioritize patching efforts against the most dangerous vulnerabilities. CISA's action follows its Binding Operational Directive 22-01 for federal agencies.
2Cisco's Critical Authentication Bypass
CVE-2026-20079 (CVSS 10.0) allows unauthenticated attackers to bypass Cisco Secure FMC's web interface authentication. This critical flaw enables execution of arbitrary scripts and potential root access to the operating system. The vulnerability affects Cisco's Firewall Management Center, a key enterprise security product. This marks the third critical Cisco vulnerability added to CISA's catalog this year.
3Google's Seventh Chrome Zero-Day
CVE-2026-87491 (CVSS 8.8) is the seventh actively exploited Chrome zero-day in 2026, affecting Google's V8 JavaScript engine. The out-of-bounds write vulnerability allows arbitrary code execution via malicious HTML pages. Google patched it in Chrome 153.0.8010.36, but exploits already exist in the wild. V8 engine vulnerabilities are particularly dangerous due to Chrome's massive user base across devices.
4Fortinet's Heap Overflow Exploit
CVE-2025-25249 (CVSS 8.1) is a heap-based buffer overflow in FortiOS and FortiSwitchManager's cw_acd daemon. Attackers can execute arbitrary code via specially crafted packets, with observed attacks deploying PivotC2 trojan. Fortinet products are widely used in enterprise networks and critical infrastructure. This follows multiple previous critical Fortinet vulnerabilities exploited by state-sponsored groups.
5Citrix NetScaler Authentication Bypass
CVE-2026-19490 (CVSS 9.3) allows attackers to bypass Citrix NetScaler ADC/Gateway authentication via SAML HTTP-Redirect binding. Successful exploitation grants unauthorized access to protected services. Citrix gateways are common in corporate remote access solutions. Similar Citrix vulnerabilities were massively exploited in the 2023 ProxyNotShell attacks.
6Federal Patching Deadlines
CISA mandates federal agencies to patch Windows flaws by September 22, 2026, and other vulnerabilities by September 12. The Binding Operational Directive requires urgent action given active exploitation. Private organizations are strongly advised to follow suit. These deadlines create pressure on IT teams during peak vulnerability disclosure season.
7Enterprise Risk Implications
The affected products are widely deployed in government and corporate networks globally. Simultaneous exploitation of multiple vendor vulnerabilities increases breach risks. Security teams face challenges prioritizing patches across diverse systems. The catalog additions highlight ongoing sophistication of cyber threats against fundamental infrastructure components.
8Strategic Cybersecurity Response
CISA's action demonstrates the growing importance of coordinated vulnerability disclosure. The KEV catalog has become essential for enterprise risk management since its 2021 launch. These disclosures test the tech industry's ability to respond to critical flaws at scale. The incidents underscore the need for continuous security monitoring beyond periodic patching cycles.