CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
Summary: CISA added three flaws affecting Cisco, Citrix, and Fortinet to its Known Exploited Vulnerabilities catalog on Wednesday, requiring Federal Civilian Executive Branch agencies to patch by September 12, 2026. Cisco said it identified three clusters of post-compromise activity on FMC instances - UAT-12197, UAT-11823, and UAT-11988 - using CVE-2026-20079 to deploy web shells and malware, while SOCRadar attributed a campaign delivering the PivotC2 Node.js RAT to a Russian-speaking, financially motivated actor that targeted more than 3,000 IP addresses and infected 178 devices, mostly in the U.S.
Why it matters: A single FortiGate flaw put a feature-rich RAT with an auto-mode flag for autonomous operations on 178 devices, and the actor behind it is chasing money, not intelligence - meaning your edge device is a revenue target, not just an espionage concern.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-25249CVE-2026-19490CVE-2026-20079
- Related
- CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026CVE-2026-19490: Citrix Net Scaler Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026