Security Advisory

This Week's Top 5 Security Developments: A Record Patch Tuesday and Four New CISA KEV Warnings

Published September 13, 2026 · Cyber One Solutions

CISA added six newly exploited vulnerabilities across Cisco, Fortinet, Citrix, and MikroTik to its Known Exploited Vulnerabilities catalog this week, while Microsoft shipped its largest Patch Tuesday on record with two actively exploited Windows zero-days. Here are the top five verified developments for small and mid-size businesses, ranked by severity, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, September 6 through Saturday, September 12, 2026, with a research cutoff of Sunday, September 13, 2026 at 6:30 a.m. Central. It was a heavier week than most: Microsoft shipped its largest security update on record, and CISA added six newly exploited vulnerabilities across four different vendors to its Known Exploited Vulnerabilities (KEV) catalog, each carrying a remediation deadline that had already passed or fell the same day this brief published.

Executive Summary and Priorities

Five verified developments met our bar for inclusion this week, all tied to confirmed or actively investigated exploitation rather than a routine patch alone, ranked by severity, evidence of exploitation, business impact, and urgency:

Cisco Secure Firewall Management Center: a maximum-severity authentication bypass under confirmed active exploitation, with a nation-state actor possibly using it and a ransomware operator exploiting a related flaw on the same platform.
Microsoft's record September Patch Tuesday: two actively exploited Windows privilege-escalation zero-days among a record-setting release.
Fortinet FortiOS and FortiSwitchManager: a firewall flaw patched quietly last year that is now under active exploitation, with CISA requiring forensic triage.
Citrix NetScaler: a second NetScaler authentication bypass disclosed this quarter, now showing signs of exploitation attempts.
MikroTik RouterOS: small-office and ISP-supplied routers being hijacked through a newly disclosed exploit chain.

How We Ranked This Week's Developments

We ranked these five by CVSS severity, independently confirmed evidence of exploitation (a CISA KEV listing, a vendor's own confirmation, or a national CERT's technical writeup), how broadly the affected product sits across our clients' environments, and how much time remains before a remediation deadline passes. A high CVSS score alone did not earn a spot on this list without confirmed exploitation evidence behind it.

1A Maximum-Severity Cisco Firewall Bypass Is Under Active Exploitation

Cisco disclosed CVE-2026-20079, an authentication bypass in Secure Firewall Management Center (FMC) carrying a maximum CVSS v3.1 base score of 10.0, on March 4, 2026, as part of a routine bundled advisory. On September 9, 2026, Cisco updated that advisory to confirm its Product Security Incident Response Team "became aware of active exploitation of this vulnerability," and Cisco Talos published a technical writeup the same day describing three separate intrusion clusters: one that exploited the flaw directly, a second Talos assessed with high confidence as an advanced actor whose tooling overlaps with Sandworm and that deployed the Cyclops Blink implant, and a third, a ransomware operator, that used a related static-credential flaw (CVE-2026-20316) to log in and ultimately deploy the Qilin ransomware family, according to Cisco's security advisory and Cisco Talos. CISA added the flaw to its KEV catalog the same day with a September 12, 2026 remediation deadline, a date that has already passed as of this brief's publication, per CISA's alert.

This affects on-premises Secure FMC Software on the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 release trains, which Cisco says has no workaround and must be patched directly; the cloud-delivered Cisco Security Cloud Control (SCC) Firewall Management service was already fixed automatically, and Secure Firewall Device Manager, ASA Software, FTD Software, and SCC's separate Defense Orchestrator service are not affected. If your business or IT provider runs an on-premises FMC appliance managing firewalls in front of patient data, customer financial information, or a network carrying nonpublic personal information, treat this as a potential incident, not only a patch ticket: the flaw has been public since March, so a log review should reach back to that date, not just to September. We covered the technical detail in full in our News & Advisories coverage when Cisco confirmed exploitation; if your organization has not yet confirmed and documented its response, that documentation, not just the patch itself, is what a HIPAA risk analysis or an FTC Safeguards program review will ask for later.

2Microsoft's Record Patch Tuesday Includes Two Exploited Windows Flaws

Microsoft's September 8, 2026 Security Update Guide release fixed 966 vulnerabilities, 105 of them rated Critical, by far its largest single release on record and well above July's 570 and August's roughly 400, according to BleepingComputer's analysis of the release. Two elevation-of-privilege flaws are confirmed under active exploitation in Microsoft's own Security Update Guide: CVE-2026-81963, described by Microsoft as "improper link resolution before file access ('link following') in Windows Update Stack [that] allows an authorized attacker to elevate privileges locally," and CVE-2026-85880, a "heap-based buffer overflow in Windows ALPC [that] allows an authorized attacker to elevate privileges locally," both rated CVSS 7.8, per Microsoft's Security Update Guide.

Both flaws require an attacker to already have low-privilege code execution on a device, meaning they are not an internet-facing entry point by themselves; they are the second stage an attacker uses after a phishing click, a malicious download, or another initial compromise to escalate from a standard user account to full SYSTEM control. That makes them a test of your broader endpoint defenses as much as your patch cadence: an organization that blocks the initial phishing email or malicious attachment never lets an attacker reach the point where either flaw matters, but one that relies on patching alone as a backstop needs every workstation actually rebooted onto the September updates, not just showing them as downloaded. Confirm with your IT provider or MSP that this month's unusually large update has been fully installed and that affected servers and workstations have restarted, and ask whether your organization's phishing-resistant multifactor authentication and endpoint detection controls, the layers that stop the initial foothold these flaws are chained from, are current. If you want a benchmark for what a managed IT provider's patch cadence should look like against a release this size, our Managed IT Buyers Guide has a scorecard for that conversation.

3A Year-Old Fortinet Firewall Flaw Is Now Under Active Exploitation

Fortinet quietly fixed CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon that handles CAPWAP wireless-controller traffic on FortiOS and FortiSwitchManager, in builds shipped between August and November 2025, then published the advisory (FG-IR-25-084) on January 13, 2026. The flaw requires no authentication and no user interaction, and the National Institute of Standards and Technology's National Vulnerability Database rates it CVSS v3.1 9.8, Critical (Fortinet's own advisory rates it lower, at 8.1); it affects FortiOS 6.4 (all versions), 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3, and FortiSwitchManager 7.0.0 through 7.0.5 and 7.2.0 through 7.2.6. CISA added it to its KEV catalog on September 9, 2026 with a September 12, 2026 deadline, and, notably, directed federal agencies to complete forensic triage on affected systems, not only apply the patch, per CISA's alert. Independent researchers have separately reported observing a post-exploitation tool they have dubbed PivotC2 deployed after exploitation, though that detail comes from private-sector research rather than Fortinet or CISA directly.

The forensic-triage instruction is the detail worth sitting with: this is not "patch when convenient." If your FortiGate or FortiSwitchManager deployment was on an affected build at any point after the August 2025 fixed releases became available and before you confirmed the upgrade, CISA's own guidance treats that as reason to look for signs of compromise, not just to apply the update going forward. Confirm your current build against Fortinet's fixed versions, and if you cannot show when you actually upgraded relative to those dates, have your IT provider review firewall and CAPWAP-related logs for the intervening period.

4A Second Citrix NetScaler Bypass Shows Signs of Exploitation

Citrix disclosed CVE-2026-19490, an authentication bypass in NetScaler ADC and Gateway rated CVSS v4.0 9.3, on August 19, 2026 in bulletin CTX696939. It is a separate, unrelated flaw from CVE-2026-8452, the NetScaler remote-code-execution bug we covered in late August, reachable when an appliance is configured as a Gateway or AAA virtual server (the configuration used for SSL VPN, ICA proxy, CVPN, or RDP proxy). Vulnerability intelligence firm Previdian reported detecting requests matching a public proof-of-concept beginning September 3, 2026, though its founder was careful to note this "provides evidence of exploitation attempts, but it does not confirm successful compromise of real-world systems." CISA added the flaw to its KEV catalog on September 9, 2026 with a September 12, 2026 deadline. We covered the full detail in our News & Advisories coverage when the exploitation attempts were first reported.

The fixed builds, 14.1-73.32 and later or 13.1-63.21 and later, are the same ones that closed the earlier NetScaler flaw, so an organization that already upgraded for CVE-2026-8452 is very likely already protected here as well. Confirm that with your IT provider rather than assuming it, and have both fixes documented as separate findings with separate dates: a regulator, auditor, or cyber-insurance underwriter reviewing your remote-access patch history will want to see that you tracked each vulnerability on its own, not folded into one vague "NetScaler was updated" entry.

5Small-Office Routers Hijacked Through New MikroTik Flaws

Poland's national CERT, CERT Polska, disclosed six vulnerabilities in MikroTik RouterOS on September 5, 2026 and reported observing unknown actors chaining two of them, an unauthenticated information-disclosure and denial-of-service flaw in the btest diagnostic service (CVE-2026-67277) and an SSH login-handling flaw that lets an attacker alter the trusted RouterOS policy mask to escalate privileges (CVE-2026-86060), against internet-reachable devices in an exploit chain it named "MikroTrick." The National Vulnerability Database rates CVE-2026-86060 CVSS v3.1 9.8, Critical, and CVE-2026-67277 CVSS v3.1 8.2, High. CISA added both to its KEV catalog on September 10, 2026 with a September 13, 2026 deadline, the day this brief publishes, per CISA's alert. MikroTik confirmed active exploitation and shipped fixes on September 3, 2026 in RouterOS 6.49.21, 7.23.4, and 7.24.2, stating that "most configurations are not at risk" while still recommending every user upgrade, per MikroTik's own advisory.

MikroTik routers show up more often in small-office and ISP-supplied network gear than most business owners realize, frequently installed by a telecom provider or an outgoing IT vendor with no one tracking the firmware afterward. Confirm whether any router on your network, including ones your internet provider installed, runs RouterOS, check its version against the fixed builds above, and follow MikroTik's guidance to review device logs for accounts or scripts you cannot account for after upgrading. For broader guidance on hardening business routers generally, see our earlier brief on router security hygiene.

Do Now

Confirm any on-premises Cisco Secure FMC appliance is patched, and if it was not patched before September 9, review authentication and configuration logs back to March 2026.
Check your FortiOS or FortiSwitchManager build against Fortinet's fixed versions, and flag any device that was unpatched after August 2025 for a forensic log review, not just an upgrade.
Verify your NetScaler build is 14.1-73.32 or later, or 13.1-63.21 or later, and confirm that verification is documented separately from your earlier NetScaler patch.
Confirm every MikroTik-based router in your network, including ISP-supplied equipment, is on RouterOS 6.49.21, 7.23.4, or 7.24.2 or later.
Confirm this month's Windows updates have actually installed and rebooted across your fleet, not only downloaded.

Plan Next

Ask your IT provider or MSP for a written, dated confirmation of which of this week's five items applied to your environment and when each was remediated.
Request an inventory review if you cannot currently list every internet-facing firewall, VPN gateway, and router in your environment and who owns patching it.
Review whether your phishing-resistant multifactor authentication and endpoint detection coverage is current, since this week's two Windows zero-days are only useful to an attacker after an initial foothold those controls are meant to stop.

Watch List

Whether the Department of Defense's CMMC Reform Task Force sets a new start date for Phase 2 third-party certification, which it suspended on July 13, 2026; see our prior brief if you hold or pursue DoD contracts, since Phase 1 self-assessment and DFARS obligations remain active regardless.
Whether CISA adds the four remaining MikroTik CVEs CERT Polska disclosed alongside this week's two (CVE-2026-67276, CVE-2026-67278, CVE-2026-67279, and CVE-2026-67281) to the KEV catalog.
Whether Fortinet or CISA confirm the scope of CVE-2025-25249 beyond FortiOS and FortiSwitchManager; CISA's catalog entry also references FortiSASE.

The Bottom Line

Five different products from five different vendors, each under confirmed or credibly reported active exploitation in a single week, is not a typical week, but it is a useful stress test of whether your patch management program covers every category of device it needs to, not just the ones due for a routine update. The businesses that come through weeks like this cleanly are the ones with a documented inventory of internet-facing systems, a provider who confirms patches rather than assumes them, and a record of when each fix actually landed. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions helps commercial businesses build and document that process through our managed cybersecurity and managed IT services, backed by IT and security assessments that inventory internet-facing appliances like the ones covered this week, and our FTC Safeguards Rule and GLBA compliance and HIPAA Security Rule compliance programs that document the response for you.