CISA KEV Alert: Cisco, Citrix, and Fortinet Vulnerabilities Under Active Exploitation

This advisory details three critical perimeter-device vulnerabilities added to CISA's KEV on 9 September 2026—CVE-2026-20079 (Cisco Secure FMC), CVE-2026-19490 (Citrix NetScaler ADC/Gateway), and CVE-2025-25249 (Fortinet FortiOS)—documents active exploitation and associated intrusion clusters (including Sandworm and Qilin), provides technical root-cause analysis and IOCs (e.g., /var/tmp/license.tmp, /tmp/.i.js, C2 IPs, unexpected Node.js processes), and prescribes immediate patching, network containment, credential rotation, and longer-term hardening steps.