Security Advisory

This Week's Top 5 Security Developments: A Record Patch Tuesday and a Busy Week for CISA KEV Additions

Published September 13, 2026 · Updated October 11, 2026 · Cyber One Solutions

CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities catalog this week, including six on September 9 and 10 across Cisco, Fortinet, Citrix, Google Chromium, and MikroTik, while Microsoft shipped its largest Patch Tuesday on record with two actively exploited Windows zero-days. Here are the top five verified developments for small and mid-size businesses, ranked by severity, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, September 6 through Saturday, September 12, 2026, with a research cutoff of Sunday, September 13, 2026 at 6:30 a.m. Central. It was a heavier week than most: Microsoft shipped its largest security update on record, and CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including six on September 9 and 10 across five vendors, several of them carrying a remediation deadline that had already passed or fell the same day this brief published.

Update, October 11, 2026

Several details in this edition have changed or needed correction since it was published. First, the KEV count: CISA's catalog shows 14 additions from September 6 through 12, and the September 9 and 10 additions this edition focused on were six entries across five vendors (Cisco, Fortinet, Citrix, Google Chromium, and MikroTik), not four vendors. The title and summary now match the catalog. Second, Cisco has replaced the FMC hot fixes described in item 1 with hardening releases, 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, and 10.1.0, and its revision history dates both that change and its statement confirming exploitation to September 16, 2026, not September 9; see our updated FMC advisory. Third, the NetScaler builds in item 4 are superseded by later Citrix bulletins. As of October 11, 2026, the builds to target are 14.1-73.46 or later and 13.1-64.29 or later for standard NetScaler ADC and Gateway, 14.1-73.46 FIPS or later for 14.1-FIPS, and 13.1-37.283 or later for 13.1-FIPS and 13.1-NDcPP. See our CVE-2026-88779 advisory. Finally, Patch Tuesday totals vary by tracker, so item 2 now attributes its count to BleepingComputer.

Also added to KEV this week: three more catalog additions from this window matter to small and mid-size businesses but were not ranked here. Google Chromium V8 CVE-2026-87491 was added September 9, five days after the Chrome zero-day in our September 8 brief. N-able N-central CVE-2026-86218 was added September 8, the third exploited flaw in that remote monitoring platform after the two in our August brief. ConnectWise ScreenConnect CVE-2026-84869, a flaw in a widely used remote-support tool, was added September 11. The other additions were Adobe Commerce and Magento CVE-2026-75650, GitLab CVE-2026-85706, and JFrog Artifactory CVE-2026-42016 and CVE-2026-42018; the two Windows flaws added September 8 are covered in item 2.

Executive Summary and Priorities

Five verified developments met our bar for inclusion this week, all tied to confirmed or actively investigated exploitation rather than a routine patch alone, ranked by severity, evidence of exploitation, business impact, and urgency:

Cisco Secure Firewall Management Center: a maximum-severity authentication bypass under confirmed active exploitation, with a nation-state actor possibly using it and a ransomware operator exploiting a related flaw on the same platform.
Microsoft's record September Patch Tuesday: two actively exploited Windows privilege-escalation zero-days among a record-setting release.
Fortinet FortiOS and FortiSwitchManager: a firewall flaw patched quietly last year that is now under active exploitation, with CISA requiring forensic triage.
Citrix NetScaler: a second NetScaler authentication bypass disclosed this quarter, now showing signs of exploitation attempts.
MikroTik RouterOS: small-office and ISP-supplied routers being hijacked through a newly disclosed exploit chain.

How We Ranked This Week's Developments

We ranked these five by CVSS severity, independently confirmed evidence of exploitation (a CISA KEV listing, a vendor's own confirmation, or a national CERT's technical writeup), how broadly the affected product sits across our clients' environments, and how much time remains before a remediation deadline passes. A high CVSS score alone did not earn a spot on this list without confirmed exploitation evidence behind it.

1. A Maximum-Severity Cisco Firewall Bypass Is Under Active Exploitation

Cisco disclosed CVE-2026-20079, an authentication bypass in Secure Firewall Management Center (FMC) carrying a maximum CVSS v3.1 base score of 10.0, on March 4, 2026, as part of a routine bundled advisory. Cisco's advisory confirms that its Product Security Incident Response Team "became aware of active exploitation of this vulnerability" (Cisco's revision history dates that statement to September 16, 2026), and on September 9 Cisco Talos published a technical writeup describing three separate intrusion clusters: one that exploited the flaw directly, a second Talos assessed with high confidence as an advanced actor whose tooling overlaps with Sandworm and that deployed the Cyclops Blink implant, and a third, a ransomware operator, that used a related static-credential flaw (CVE-2026-20316) to log in and ultimately deploy the Qilin ransomware family, according to Cisco's security advisory and Cisco Talos. CISA added the flaw to its KEV catalog the same day with a September 12, 2026 remediation deadline, a date that has already passed as of this brief's publication, per CISA's alert.

This affects on-premises Secure FMC Software, which Cisco says has no workaround and must be patched directly (Cisco has since replaced its hot fixes for the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 trains with hardening releases that also cover 10.1; see the October 11 update above); the cloud-delivered Cisco Security Cloud Control (SCC) Firewall Management service was already fixed automatically, and Secure Firewall Device Manager, ASA Software, FTD Software, and SCC's separate Defense Orchestrator service are not affected. If your business or IT provider runs an on-premises FMC appliance managing firewalls in front of patient data, customer financial information, or a network carrying nonpublic personal information, treat this as a potential incident, not only a patch ticket: the flaw has been public since March, so a log review should reach back to that date, not just to September. We covered the technical detail in full in our News & Advisories coverage when Cisco confirmed exploitation; if your organization has not yet confirmed and documented its response, that documentation, not just the patch itself, is what a HIPAA risk analysis or an FTC Safeguards program review will ask for later.

2. Microsoft's Record Patch Tuesday Includes Two Exploited Windows Flaws

Microsoft's September 8, 2026 Security Update Guide release fixed more than 960 vulnerabilities (966 by BleepingComputer's count, 105 of them rated Critical; other trackers' totals differ slightly), by far its largest single release on record and well above July's 570 and August's roughly 400, according to BleepingComputer's analysis of the release. Two elevation-of-privilege flaws are confirmed under active exploitation in Microsoft's own Security Update Guide: CVE-2026-81963, described by Microsoft as "improper link resolution before file access ('link following') in Windows Update Stack [that] allows an authorized attacker to elevate privileges locally," and CVE-2026-85880, a "heap-based buffer overflow in Windows ALPC [that] allows an authorized attacker to elevate privileges locally," both rated CVSS 7.8, per Microsoft's Security Update Guide.

Both flaws require an attacker to already have low-privilege code execution on a device, meaning they are not an internet-facing entry point by themselves; they are the second stage an attacker uses after a phishing click, a malicious download, or another initial compromise to escalate from a standard user account to full SYSTEM control. That makes them a test of your broader endpoint defenses as much as your patch cadence: an organization that blocks the initial phishing email or malicious attachment never lets an attacker reach the point where either flaw matters, but one that relies on patching alone as a backstop needs every workstation actually rebooted onto the September updates, not just showing them as downloaded. Confirm with your IT provider or MSP that this month's unusually large update has been fully installed and that affected servers and workstations have restarted, and ask whether your organization's phishing-resistant multifactor authentication and endpoint detection controls, the layers that stop the initial foothold these flaws are chained from, are current. If you want a benchmark for what a managed IT provider's patch cadence should look like against a release this size, our Managed IT Buyers Guide has a scorecard for that conversation.

3. A Year-Old Fortinet Firewall Flaw Is Now Under Active Exploitation

Fortinet quietly fixed CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon that handles CAPWAP wireless-controller traffic on FortiOS and FortiSwitchManager, in builds shipped between August and November 2025, then published the advisory (FG-IR-25-084) on January 13, 2026. The flaw requires no authentication and no user interaction, and the National Institute of Standards and Technology's National Vulnerability Database rates it CVSS v3.1 9.8, Critical (Fortinet's own advisory rates it lower, at 8.1); it affects FortiOS 6.4 (all versions), 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3, and FortiSwitchManager 7.0.0 through 7.0.5 and 7.2.0 through 7.2.6. CISA added it to its KEV catalog on September 9, 2026 with a September 12, 2026 deadline, and, notably, directed federal agencies to complete forensic triage on affected systems, not only apply the patch, per CISA's alert. Independent researchers have separately reported observing a post-exploitation tool they have dubbed PivotC2 deployed after exploitation, though that detail comes from private-sector research rather than Fortinet or CISA directly.

The forensic-triage instruction is the detail worth sitting with: this is not "patch when convenient." If your FortiGate or FortiSwitchManager deployment was on an affected build at any point after the August 2025 fixed releases became available and before you confirmed the upgrade, CISA's own guidance treats that as reason to look for signs of compromise, not just to apply the update going forward. Confirm your current build against Fortinet's fixed versions, and if you cannot show when you actually upgraded relative to those dates, have your IT provider review firewall and CAPWAP-related logs for the intervening period.

4. A Second Citrix NetScaler Bypass Shows Signs of Exploitation

Citrix disclosed CVE-2026-19490, an authentication bypass in NetScaler ADC and Gateway rated CVSS v4.0 9.3, on August 19, 2026 in bulletin CTX696939. It is a separate, unrelated flaw from CVE-2026-8452, the NetScaler remote-code-execution bug we covered in late August, reachable when an appliance is configured as a Gateway or AAA virtual server (the configuration used for SSL VPN, ICA proxy, CVPN, or RDP proxy). Vulnerability intelligence firm Previdian reported detecting requests matching a public proof-of-concept beginning September 3, 2026, though its founder was careful to note this "provides evidence of exploitation attempts, but it does not confirm successful compromise of real-world systems." CISA added the flaw to its KEV catalog on September 9, 2026 with a September 12, 2026 deadline. We covered the full detail in our News & Advisories coverage when the exploitation attempts were first reported.

The fixed builds, 14.1-73.32 and later or 13.1-63.21 and later (since superseded; see the October 11 update above), are the same ones that closed the earlier NetScaler flaw, so an organization that already upgraded for CVE-2026-8452 is very likely already protected here as well. Confirm that with your IT provider rather than assuming it, and have both fixes documented as separate findings with separate dates: a regulator, auditor, or cyber-insurance underwriter reviewing your remote-access patch history will want to see that you tracked each vulnerability on its own, not folded into one vague "NetScaler was updated" entry.

5. Small-Office Routers Hijacked Through New MikroTik Flaws

Poland's national CERT, CERT Polska, disclosed six vulnerabilities in MikroTik RouterOS on September 5, 2026 and reported observing unknown actors chaining two of them, an unauthenticated information-disclosure and denial-of-service flaw in the btest diagnostic service (CVE-2026-67277) and an SSH login-handling flaw that lets an attacker alter the trusted RouterOS policy mask to escalate privileges (CVE-2026-86060), against internet-reachable devices in an exploit chain it named "MikroTrick." The National Vulnerability Database rates CVE-2026-86060 CVSS v3.1 9.8, Critical, and CVE-2026-67277 CVSS v3.1 8.2, High. CISA added both to its KEV catalog on September 10, 2026 with a September 13, 2026 deadline, the day this brief publishes, per CISA's alert. MikroTik confirmed active exploitation and shipped fixes on September 3, 2026 in RouterOS 6.49.21, 7.23.4, and 7.24.2, stating that "most configurations are not at risk" while still recommending every user upgrade, per MikroTik's own advisory.

MikroTik routers show up more often in small-office and ISP-supplied network gear than most business owners realize, frequently installed by a telecom provider or an outgoing IT vendor with no one tracking the firmware afterward. Confirm whether any router on your network, including ones your internet provider installed, runs RouterOS, check its version against the fixed builds above, and follow MikroTik's guidance to review device logs for accounts or scripts you cannot account for after upgrading. For broader guidance on hardening business routers generally, see our earlier brief on router security hygiene.

Do Now

Confirm any on-premises Cisco Secure FMC appliance is on Cisco's hardening release for its train (see the October 11 update above), and if it was not patched before September 9, review authentication and configuration logs back to March 2026.
Check your FortiOS or FortiSwitchManager build against Fortinet's fixed versions, and flag any device that was unpatched after August 2025 for a forensic log review, not just an upgrade.
Verify your NetScaler build is 14.1-73.32 or later, or 13.1-63.21 or later (now superseded: target 14.1-73.46 or 13.1-64.29, see the October 11 update above), and confirm that verification is documented separately from your earlier NetScaler patch.
Confirm every MikroTik-based router in your network, including ISP-supplied equipment, is on RouterOS 6.49.21, 7.23.4, or 7.24.2 or later.
Confirm this month's Windows updates have actually installed and rebooted across your fleet, not only downloaded.

Plan Next

Ask your IT provider or MSP for a written, dated confirmation of which of this week's five items applied to your environment and when each was remediated.
Request an inventory review if you cannot currently list every internet-facing firewall, VPN gateway, and router in your environment and who owns patching it.
Review whether your phishing-resistant multifactor authentication and endpoint detection coverage is current, since this week's two Windows zero-days are only useful to an attacker after an initial foothold those controls are meant to stop.

Watch List

Whether the Department of Defense's CMMC Reform Task Force sets a new start date for Phase 2 third-party certification, which it suspended on July 13, 2026; see our prior brief if you hold or pursue DoD contracts, since Phase 1 self-assessment and DFARS obligations remain active regardless.
Whether CISA adds the four remaining MikroTik CVEs CERT Polska disclosed alongside this week's two (CVE-2026-67276, CVE-2026-67278, CVE-2026-67279, and CVE-2026-67281) to the KEV catalog.
Whether Fortinet or CISA confirm the scope of CVE-2025-25249 beyond FortiOS and FortiSwitchManager; CISA's catalog entry also references FortiSASE.

The Bottom Line

Five different products from five different vendors, each under confirmed or credibly reported active exploitation in a single week, is not a typical week, but it is a useful stress test of whether your patch management program covers every category of device it needs to, not just the ones due for a routine update. The businesses that come through weeks like this cleanly are the ones with a documented inventory of internet-facing systems, a provider who confirms patches rather than assumes them, and a record of when each fix actually landed. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions helps commercial businesses build and document that process through our managed cybersecurity and managed IT services, backed by IT and security assessments that inventory internet-facing appliances like the ones covered this week, and our FTC Safeguards Rule and GLBA compliance and HIPAA Security Rule compliance programs that document the response for you.