CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesdayaddedthree flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.

The vulnerabilities are listed below -

The development comes as Ciscoupdated its advisoryfor CVE-2026-20079 to note that it became aware of active exploitation efforts targeting the flaw in August 2026. It did not disclose any additional details.

Cisco routers have been an attack magnet in recent years. In a report published late last month, Sygniasaidit observed a China-nexus cyber espionage group dubbed Fire Ant obtaining unauthorized access to Cisco IOS XR routers and abusing them to facilitate persistence, data collection, and burrow deeper into high-value networks via custom malware.

"This behavior shifts the router's role from a transit device to a collection platform," the cybersecurity company noted. "Once the actor controlled the router, the device became a vantage point for observing traffic moving through trusted network paths."

CVE-2026-19490, on the other hand, haswitnessedexploitation activity targeting Previdian's honeypot systems, with a total of 56 attempts registered since September 3, 2026. Of these, 36 attempts wererecordedon September 8, 2026, alone.

The addition of CVE-2025-25249 to the KEV catalog follows areportfrom SOCRadar about a malicious attack campaign that's suspected to have weaponized the flaw to deliver a feature-rich Node.js remote access trojan (RAT) codenamed PivotC2. The post-exploitation framework supports features such as interactive shells, tunneling, network scanning, and configuration harvesting.

More than 3,000 IP addresses are estimated to have been targeted as part of the campaign, resulting in the infection of 178 devices with PivotC2. The majority of the compromises are concentrated in the U.S. The activity is assessed to be the work of a Russian-speaking threat actor driven by financial gain. The earliest evidence of active exploitation of the flaw dates back to July 2026.

In the observed attacks, a shell script containing an exploit binary targets a vulnerable FortiGate instance to establish a reverse shell and run a single-line JavaScript command via Node.js. This, in turn, leads to the download of a second-stage JavaScript payload, which is decrypted and executed to deliver PivotC2.

"PivotC2 establishes a persistent outbound TLS connection to a remote command-and-control (C2) server. Its feature set includes interactive shells, file transfers, SOCKS5/HTTP proxy tunneling, local and remote port forwarding, CIDR-range scanning, and FortiGate-specific configuration harvesting and credential decryption," SOCRadar said. "An auto-mode flag enables autonomous operations, automatically running a predefined command sequence upon initial infection."

The findings once again demonstrate that threat actors are continuously scanning exposed perimeter edge devices to obtain initial access by taking advantage of their lack of robust monitoring or telemetry logging. SOCRadar is recommending organizations using Fortinet products to limit internet access, hunt for indicators of compromise, rotate credentials, and apply the latest patches.