CISA 2026-09-09

CISA KEV — Fortinet Multiple Products (CVE-2025-25249) +3 more

Machine-generated analysis · WAYSCloud LLM

Four actively exploited CVEs affecting Fortinet, Citrix NetScaler, Google Chromium V8, and Cisco FMC have been added to CISA’s KEV Catalog.

Context

The advisory lists CVE-2025-25249 (Fortinet multiple products heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass). CISA states these vulnerabilities are being actively exploited and that agencies should prioritize rapid remediation on publicly exposed assets. The notice references BOD 26-04, which requires checking for compromise before applying fixes.

Operator considerations

Check: inventory any deployed Fortinet, Citrix NetScaler, Chromium V8, and Cisco FMC versions that match the listed CVEs.
Isolate: segment or restrict public access to affected instances until mitigated.
Patch: apply vendor-provided patches or mitigations for each CVE as soon as they are released, prioritizing assets that grant total control.
Log: monitor authentication logs and exploit-related indicators for the listed vulnerabilities.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability

CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV...

Read the full advisory on CISA →