- Engineer — Act: CVE-2026-20079 carries a CVSS 10.0, is KEV-listed, has a public PoC, and EPSS 0.75 — all three signal immediate exploitation pressure on Cisco, Citrix, and Fortinet devices common in enterprise perimeters; patch all three affected products to vendor-specified fixed versions before September 12.
- SOC/IR — Act: Active exploitation of edge appliances from all three vendors means assume-breach posture is warranted — hunt for anomalous authentication events and lateral movement originating from Cisco, Citrix, and Fortinet devices since before today’s disclosure, and sweep for any available IOCs tied to these CVEs.
- Leader — Act: Three critical-severity, actively exploited flaws across widely deployed network vendors represent a systemic perimeter risk; confirm your team has prioritized patching all affected Cisco, Citrix, and Fortinet products before the Sept 12 deadline, and verify no prior compromise occurred on exposed appliances.
- Signals: CVE-2026-20079 — CISA KEV: listed, EPSS 0.75, public PoC on GitHub, reported by 2 collected sources