CISA adds exploited Cisco, Citrix, Fortinet flaws to KEV, sets Sept. 12, 2026 federal patch deadline

The Cybersecurity and Infrastructure Security Agency on Wednesday added three exploited vulnerabilities affecting Cisco, Citrix, and Fortinet to its Known Exploited Vulnerabilities catalog and set a Sept. 12, 2026 remediation deadline for federal agencies, The Hacker News reports. The KEV listing confirms in-the-wild exploitation and triggers mandatory patching for FCEB networks. With the flaws tied to core networking and remote access products, they raise the risk of lateral movement across government networks.

One tracked issue, CVE-2026-20079, carries a maximum CVSS score of 10.0, underscoring the severity, according to The Hacker News. CISA’s directive requires FCEB agencies to prioritize fixes by the deadline and strongly signals enterprises beyond government should review exposure and patch paths now. Watch for updated vendor and CISA advisories with technical guidance, IOCs, and any expansion of the KEV entry before the Sept. 12 deadline. [Developing. This article will be updated.]