CISA Adds Actively Exploited Cisco, Citrix, Fortinet, and Google Vulnerabilities to KEV Catalog

On September 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four critical security flaws to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation by cyber threats. The vulnerabilities include CVE-2026-20079, a maximum-severity authentication bypass in Cisco Secure Firewall Management Center (FMC) that allows remote attackers to obtain root access; CVE-2026-19490, a critical authentication bypass in Citrix NetScaler ADC and Gateway; CVE-2025-25249, a heap-based buffer overflow in Fortinet FortiOS; and CVE-2026-87491, an out-of-bounds write flaw in Google Chromium V8. Under Binding Operational Directive 26-04, CISA mandated that Federal Civilian Executive Branch agencies prioritize the remediation of these vulnerabilities by September 12, 2026. Security researchers warned that these flaws are actively exploited in the wild by state-sponsored cyber espionage groups and ransomware operators to breach corporate networks, deploy malware, and exfiltrate sensitive data. Cybersecurity experts advise private sector organizations to perform immediate forensic checks and update their security infrastructure to mitigate risk.