Security2 publishers2 min readPublished
A CVSS 10.0 Cisco FMC bypass tops the four flaws CISA moved into KEV
CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.
The Watch · Security desk
What happened
- CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, covering Fortinet, Citrix NetScaler, Google Chromium V8 and Cisco Firewall Management Center, citing evidence of active exploitation.
- Security Affairs reported that exploitation of the Fortinet heap overflow CVE-2025-25249 has included attacks deploying the PivotC2 remote access trojan onto compromised FortiGate devices.
- The V8 out-of-bounds write CVE-2026-87491 runs arbitrary code inside Chrome's sandbox from a crafted HTML page and is fixed in Chrome 153.0.8010.36 and later.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Three of the four sit on appliances an attacker can reach unprompted with no credentials, so the exposure does not depend on a user clicking anything or on a browser update cycle finishing.
- contradiction CISA's alert governs these four under BOD 26-04 with no date attached, while Security Affairs writes up the older BOD 22-01 and prints two dates, one of which belongs to Windows flaws absent from the list.
- decision Under BOD 26-04 a federal patch queue ranks on whether the asset is publicly exposed and whether exploitation grants total control, which puts the FMC and NetScaler boxes ahead of the browser fleet.
- constraint Patching is only half of what 26-04 asks: agencies also have to determine whether the system was compromised before the fix landed, and on an authentication bypass that means hunting without a failed-login trail.
The Cisco bug is the one to sequence first. CVE-2026-20079 sits in Secure FMC's web interface, and an unauthenticated remote attacker who can reach that interface sends crafted HTTP requests, executes scripts, and can end up with root on the underlying operating system [2]. CISA's catalog entry names the product Cisco Firewall Management Center [3].
Citrix's CVE-2026-19490 is an authentication bypass through the SAML HTTP-Redirect binding on NetScaler ADC and NetScaler Gateway, rated 8.1 lower at 9.3, and it also needs no credentials [9]. Fortinet's CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon in FortiOS and FortiSwitchManager, rated 8.1, reachable by crafted packets from an unauthenticated source [7]. Security Affairs reported that exploitation has included attacks deploying the PivotC2 remote access trojan on compromised FortiGate devices [8]. That CVE carries a 2025 identifier while the other three carry 2026 ones [18].
Three of the four are reachable without credentials [15]. The fourth needs a user to load a page: CVE-2026-87491 is an out-of-bounds write in V8 that executes arbitrary code inside Chrome's sandbox from a crafted HTML page, fixed in Chrome 153.0.8010.36 and later [4]. Google's advisory said "Google is aware that an exploit for CVE-2026-87491 exists in the wild." [6]. Security Affairs counted it as the seventh actively exploited Chrome zero-day of 2026 [5].
CISA's alert cites Binding Operational Directive 26-04, which requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, and to defer lower-risk work [10]. The alert sets no remediation date for any of the four [17]. Security Affairs cited the older BOD 22-01 and reported that CISA orders agencies to fix the Windows flaws by September 22, 2026, with the remaining ones due September 12, 2026 [13][14]. No Windows CVE appears among the four CISA listed [16].
So the date to plan against, for federal readers, is the one Security Affairs prints for the batch and CISA does not: September 12 [14][17]. Private-sector readers get no date at all. CISA says 26-04 binds FCEB agencies only, and encourages every other organization to prioritize KEV remediation [12].
BOD 26-04 also sets expectations for when agencies must check whether threat actors compromised a system before the patch went on [11]. For the FMC and NetScaler flaws that is the larger job, because both are authentication bypasses [2][9]. Under 26-04 the ranking criterion is total control of a publicly exposed asset after exploitation, and root on the FMC host meets it [2][10].
What to watch
- Whether CISA publishes per-CVE remediation dates for these four under BOD 26-04, or leaves the timing to agency risk triage.
- Whether PivotC2 activity on FortiGate devices is tied to a named actor or spreads to FortiSwitchManager deployments.
- Whether the NetScaler SAML HTTP-Redirect bypass shows up in reported intrusions at named victims, and at what scale.