CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

CISA has added three zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog that are actively being exploited by threat actors. CVE-2026-20079 is an authentication bypass vulnerability (CVSS 10.0) in Cisco Secure Firewall Management Center that allows an unauthenticated attacker to execute script files and obtain root access to the operating system. Additional affected vendors include Citrix and Fortinet, with CVE-2025-25249 in Fortinet products being leveraged to deliver the remote access trojan PivotC2. The campaign demonstrates targeted reconnaissance of exposed edge devices with weak telemetry logging as an initial access vector. US federal agencies face a patching deadline of September 12, 2026.