CISA KEV: Cisco, Citrix, Fortinet Flaws Actively Exploited, Patch by Sept 12

Thu, 10 Sep 2026 14:58:06 +0000

Engineer — Act: CVE-2026-20079 carries a CVSS 10.0, is KEV-listed, has a public PoC, and EPSS 0.75 — all three signal immediate exploitation pressure on Cisco, Citrix, and Fortinet devices common in enterprise perimeters; patch all three affected products to vendor-specified fixed versions before September 12.
SOC/IR — Act: Active exploitation of edge appliances from all three vendors means assume-breach posture is warranted — hunt for anomalous authentication events and lateral movement originating from Cisco, Citrix, and Fortinet devices since before today’s disclosure, and sweep for any available IOCs tied to these CVEs.
Leader — Act: Three critical-severity, actively exploited flaws across widely deployed network vendors represent a systemic perimeter risk; confirm your team has prioritized patching all affected Cisco, Citrix, and Fortinet products before the Sept 12 deadline, and verify no prior compromise occurred on exposed appliances.
Signals: CVE-2026-20079 — CISA KEV: listed, EPSS 0.75, public PoC on GitHub, reported by 2 collected sources

Network-Appliances on CuraSec