CISA KEV Adds CVE-2025-25249, CVE-2026-19490, CVE-2026-87491, CVE-2026-20079: Fortinet, Citrix, Chrome, and Cisco FMC Under Active Exploitation — Defense Guide

On September 9, 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild:

• CVE-2025-25249 — Fortinet multiple products, heap-based buffer overflow
• CVE-2026-19490 — Citrix NetScaler, authentication bypass via alternate path or channel
• CVE-2026-87491 — Google Chromium V8, out-of-bounds write
• CVE-2026-20079 — Cisco Secure Firewall Management Center (FMC), authentication bypass via alternate path or channel

This is not a theoretical exercise. KEV inclusion means CISA has reliable evidence that adversaries are exploiting these flaws against real targets. Under Binding Operational Directive (BOD) 26-04, federal civilian agencies are required to remediate KEV-listed vulnerabilities within defined timelines — and every private-sector organization running these products should treat the same deadlines as their own, because the threat actors certainly are not limiting themselves to .gov networks.

The pattern in this batch should concern every defender: two of the four are authentication bypasses on perimeter and management-plane appliances (NetScaler and Cisco FMC), one is a memory corruption flaw in a network security product (Fortinet), and one is a browser engine zero-day class bug (Chrome V8). That is a full-spectrum intrusion kit — initial access at the edge, session theft without credentials, and client-side code execution through the browser.

Technical Analysis

CVE-2025-25249 — Fortinet Heap-Based Buffer Overflow

A heap-based buffer overflow (CWE-122) affecting multiple Fortinet products. Heap overflows in network security appliances are typically reachable through a network-exposed service — often the SSL-VPN, management interface, or a protocol parsing daemon — and allow a remote attacker to corrupt heap metadata and achieve arbitrary code execution in the context of the affected process, which on Fortinet appliances almost universally runs with elevated privileges.

From a defender's perspective, the critical facts are:

• Pre-authentication reachability is the norm for this class of Fortinet bug. The targeted daemons listen on interfaces exposed to the internet in most deployments.
• Successful exploitation typically yields a foothold on the appliance itself, from which attackers establish persistence (modified boot scripts, implanted binaries, rogue admin accounts) and pivot into the internal network.
• Post-exploitation on FortiOS frequently involves writes to the filesystem outside the firmware image, creation of local administrator accounts, and enabling of management services on unexpected ports.

CVE-2026-19490 — Citrix NetScaler Authentication Bypass (Alternate Path or Channel)

An authentication bypass using an alternate path or channel (CWE-288) in Citrix NetScaler ADC and NetScaler Gateway. This CWE category means the application exposes a secondary route — an alternate endpoint, API path, or protocol handler — that fails to enforce the same authentication checks as the primary interface.

NetScaler has been one of the most heavily targeted perimeter products of the last several years, and for good reason: it brokers authenticated access to internal applications and virtual desktops. An authentication bypass here typically allows an attacker to:

• Hijack or mint authenticated sessions without valid credentials.
• Access the management interface or gateway virtual servers as a privileged user.
• Harvest credentials and session tokens from the appliance for downstream lateral movement.

Expect exploitation attempts against the gateway and management endpoints (/vpn/, /logon/, /cgi/, and the NSIP management interface) from untrusted source addresses.

CVE-2026-87491 — Google Chromium V8 Out-of-Bounds Write

An out-of-bounds write (CWE-787) in V8, the JavaScript engine underpinning Google Chrome and every Chromium-based browser (Edge, Brave, Opera, and embedded Chromium frameworks). OOB writes in V8 are the classic zero-day primitive: triggered by malicious JavaScript delivered via a compromised or attacker-controlled page, they are typically chained with a sandbox escape to achieve full host compromise.

Key defensive considerations:

• Exploitation requires nothing more than a user visiting a malicious page — watering holes, malvertising, and phishing links are the delivery vectors.
• Because exploitation happens inside the renderer process, endpoint telemetry should focus on browser processes spawning unexpected child processes — a renderer spawning cmd.exe, powershell.exe, or writing executables to temp directories is a high-fidelity signal.
• Chrome's rapid release cycle means the patch is already available via the stable channel update; the primary organizational risk is unmanaged browsers and users who defer restarts.

CVE-2026-20079 — Cisco Secure Firewall Management Center Authentication Bypass

An authentication bypass using an alternate path or channel (CWE-288) in Cisco Secure Firewall Management Center. FMC is the centralized management plane for Cisco Secure Firewall Threat Defense (FTD) appliances. Compromise of FMC is a catastrophic scenario: it controls policy, deployment, and logging for every managed firewall in the environment.

An attacker who bypasses FMC authentication can:

• Modify or weaken firewall policy across the entire estate.
• Push malicious configurations or access policies to managed FTD devices.
• Suppress or tamper with logging — blinding the SOC precisely when visibility matters most.
• Harvest credentials and certificates used by managed devices.

FMC should never be internet-exposed, but we consistently find it reachable during assessments. If your FMC management interface is reachable from untrusted networks, treat this as an emergency regardless of patch status.

Exploitation Status

All four CVEs are confirmed actively exploited — that is the admission criterion for the CISA KEV Catalog. BOD 26-04 mandates remediation timelines for federal agencies; organizations should consult the KEV Catalog entry for each CVE's due date and treat it as the outer bound, not the target. Given active exploitation, the real target is this week.

Detection & Response

The detections below target post-exploitation behavior, because pre-auth exploit traffic against appliance internals is rarely visible without vendor-specific packet inspection. These are the signals that survive even when the initial exploit is silent.

Sigma Rules

---
title: Chromium Renderer Spawning Shell or Script Interpreter
id: 3f8c2a91-7d4e-4b1a-9c6e-2a5d8f0b1e34
status: experimental
description: Detects Chrome or Chromium-based browser renderer processes spawning command shells or script interpreters, consistent with V8 exploit post-exploitation activity such as CVE-2026-87491.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some enterprise browser extensions or update frameworks may spawn installers, but shells from a renderer parent warrant investigation
level: high
---
title: Browser Process Writing Executable to Temp or User Profile
id: 6b1d4e82-2c9a-4f57-8a3d-9e0c7b2f5a18
status: experimental
description: Detects Chromium-based browsers dropping executable files into temporary or user profile directories, a common payload staging behavior following browser exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.persistence
  - attack.t1203
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.bat'
      - '.ps1'
  condition: selection_process and selection_path and selection_ext
falsepositives:
  - Browser auto-update components; correlate with update service process trees and signer metadata to tune
level: medium

KQL — Microsoft Sentinel / Defender

Hunt for post-exploitation behavior against the appliance CVEs using Syslog/CEF ingestion from Fortinet, NetScaler, and FMC, and endpoint telemetry for the V8 exploit chain:

// Hunt 1: Anomalous authentication events on NetScaler and Cisco FMC management interfaces
// Look for successful admin logons from unusual sources and session creation without preceding auth challenge
let Lookback = 14d;
let ApplianceSources = dynamic(["netscaler", "cisco", "fmc", "firepower"]);
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceVendor in~ ("Citrix", "Cisco") or DeviceProduct has_any ("NetScaler", "Firepower", "FMC")
| where DeviceEventClassID has_any ("login", "auth", "session") or Message has_any ("login successful", "session established", "authentication")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, DestinationHostName, DeviceEventClassID, SourceUserName
| where EventCount > 0
| join kind=leftanti (
    // Exclude known admin source IPs observed before the KEV disclosure window
    CommonSecurityLog
    | where TimeGenerated between (ago(90d) .. ago(Lookback))
    | summarize by SourceIP
) on SourceIP
| project FirstSeen, LastSeen, SourceIP, DestinationHostName, SourceUserName, DeviceEventClassID, EventCount
| order by FirstSeen desc;

// Hunt 2: Chromium renderer spawning suspicious child processes (endpoint telemetry for CVE-2026-87491)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 3: Fortinet appliance local account creation or config change events following KEV window
Syslog
| where TimeGenerated > ago(14d)
| where Computer has_any ("forti", "fgt") or ProcessName has_any ("forti")
| where SyslogMessage has_any ("user added", "admin added", "new account", "config changed", "firmware", "script")
| project TimeGenerated, Computer, SyslogMessage, HostIP
| order by TimeGenerated desc;

Velociraptor VQL

For endpoint triage where browser exploitation is suspected, hunt for recently staged executables in user-writable directories created around browser process activity:

-- Hunt for executables staged in user-writable paths with recent creation times,
-- consistent with browser exploit payload staging (CVE-2026-87491 post-exploitation)
SELECT FullPath, Size, Created AS CreatedTime, Modified AS ModifiedTime,
       basename(path=FullPath) AS FileName
FROM glob(globs=[
    'C:/Users/*/AppData/Local/Temp/*.exe',
    'C:/Users/*/AppData/Local/Temp/*.dll',
    'C:/Users/*/AppData/Roaming/**/*.exe',
    'C:/Users/Public/*.exe'
])
WHERE CreatedTime > timestamp(epoch=now() - 1209600)  -- last 14 days
ORDER BY CreatedTime DESC

Remediation & Verification Script

Use the following to verify browser patch posture across Windows endpoints and validate that FMC/NetScaler management interfaces are not internet-reachable from the host's perspective:

# Verify Chromium browser versions against patched baselines
# Update $MinimumChromeVersion to the fixed version from the Google Chrome stable channel advisory
$MinimumChromeVersion = [version]"140.0.0.0"

$browsers = @{
    "Chrome" = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe"
    "Edge"   = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe"
}

foreach ($browser in $browsers.GetEnumerator()) {
    if (Test-Path $browser.Value) {
        $exePath = (Get-ItemProperty $browser.Value).'(default)'
        if ($exePath -and (Test-Path $exePath)) {
            $version = (Get-Item $exePath).VersionInfo.ProductVersion
            $compliant = ([version]$version -ge $MinimumChromeVersion)
            Write-Output "$($browser.Key): $version -- $(if ($compliant) {'PATCHED'} else {'VULNERABLE - UPDATE REQUIRED'})"
        }
    }
}

# Force Chrome update check via policy refresh (requires admin)
# registry-based: ensure updates are not disabled
$chromeUpdatePolicy = "HKLM:\SOFTWARE\Policies\Google\Update"
if (Test-Path $chromeUpdatePolicy) {
    $updateDisabled = (Get-ItemProperty $chromeUpdatePolicy -Name "UpdateDefault" -ErrorAction SilentlyContinue).UpdateDefault
    if ($updateDisabled -eq 0) {
        Write-Warning "Chrome updates are DISABLED via policy. Re-enable immediately."
    }
}

# Check whether FMC or NetScaler management interfaces are reachable from this segment
$managementTargets = @(
    @{ Name = "FMC-HTTPS"; Host = "fmc.internal.example.com"; Port = 443 },
    @{ Name = "NetScaler-NSIP"; Host = "nsip.internal.example.com"; Port = 443 }
)
foreach ($target in $managementTargets) {
    $result = Test-NetConnection -ComputerName $target.Host -Port $target.Port -WarningAction SilentlyContinue
    Write-Output "$($target.Name) reachable from this host: $($result.TcpTestSucceeded)"
}

# Audit for suspicious recently created local admin accounts (appliance-pivot indicator on jump hosts)
Get-LocalGroupMember -Group "Administrators" |
    Where-Object { $_.ObjectClass -eq "User" } |
    ForEach-Object {
        $user = Get-LocalUser -Name ($_.Name -split '\\')[-1] -ErrorAction SilentlyContinue
        if ($user -and $user.PasswordLastSet -gt (Get-Date).AddDays(-14)) {
            Write-Output "RECENTLY MODIFIED ADMIN: $($user.Name) - PasswordLastSet: $($user.PasswordLastSet)"
        }
    }

#!/bin/bash
# Verify FortiOS / NetScaler / FMC exposure and check for post-exploitation artifacts
# Run from a Linux management/jump host with network access to appliance segments

# 1. Enumerate externally exposed appliance management interfaces from your perimeter scan data
# Replace CIDR with your public ranges
echo "=== Scanning for exposed management interfaces ==="
nmap -sS -p 443,8443,4443,10443 --open -oG - YOUR_PUBLIC_CIDR/24 | \
  grep -i "open" | tee exposed_mgmt_interfaces.txt

# 2. FortiOS: check for unexpected admin accounts via API (requires read-only API token)
# curl -k -H "Authorization: Bearer YOUR_API_TOKEN" \
#   https://FORTIGATE_MGMT/api/v2/cmdb/system/admin | jq '.results[].name'

# 3. FortiOS: review recent configuration changes for unauthorized modifications
# grep -i "config" /var/log/fortigate_event.log | grep -iE "add|edit|delete" | tail -50

# 4. NetScaler: verify build against Citrix advisory fixed builds
# On the NetScaler shell: show ns version
# Compare against the fixed build numbers in the Citrix security bulletin for CVE-2026-19490

# 5. Check shell history and cron on appliances for persistence artifacts
echo "=== Checking for persistence artifacts ==="
ls -la /var/tmp /tmp 2>/dev/null | grep -vE "^total|^d" 
crontab -l 2>/dev/null
cat /etc/cron.d/* 2>/dev/null

# 6. Audit FMC access logs for authentication anomalies
echo "=== FMC auth anomalies ==="
grep -iE "authentication|login" /var/log/messages 2>/dev/null | \
  grep -iE "success|accepted" | awk '{print $NF}' | sort | uniq -c | sort -rn | head -20

echo "Review all output against known-good baselines before the BOD 26-04 remediation deadline."

Remediation

Treat all four CVEs as emergency patch candidates. Specific actions per product:

CVE-2025-25249 — Fortinet

• Apply the fixed firmware releases identified in Fortinet's PSIRT advisory (FG-IR bulletin for CVE-2025-25249) across all affected products — FortiOS, FortiProxy, and any other listed products. Consult https://www.fortiguard.com/psirt for the exact fixed version per product train.
• If patching must be staged, disable or ACL-restrict the vulnerable service (SSL-VPN or management interface) from untrusted networks immediately.
• After patching, conduct an integrity review: audit local admin accounts, review configuration change history for the past 90 days, inspect for unexpected files and scheduled tasks, and rotate all credentials stored on or transiting the appliance. Patching a compromised appliance does not evict the attacker.

CVE-2026-19490 — Citrix NetScaler

• Upgrade to the fixed NetScaler ADC/Gateway builds listed in the Citrix security bulletin for CVE-2026-19490 (https://support.citrix.com — search the CVE for the canonical bulletin and fixed build numbers per release train).
• Ensure the NSIP management interface is reachable only from a dedicated management VLAN. It must never be internet-exposed.
• After patching, terminate all active sessions (authentication bypass means existing sessions may be attacker-controlled): kill icaconnection -all equivalents and forced re-authentication. Rotate service account credentials and any certificates private keys that may have been exposed.
• Review gateway and AAA logs for sessions established without corresponding authentication events during the exposure window.

CVE-2026-87491 — Google Chromium V8

• Update Chrome to the patched stable channel version per the Chrome Releases blog (https://chromereleases.googleblog.com). Chromium-based Edge, Brave, and Opera will ship corresponding fixes — verify each.
• Enforce browser restart compliance: a patched binary does nothing for users with 30-day-old sessions. Use endpoint management (Intune, GPO RelaunchNotification, or equivalent) to force restart windows.
• Verify auto-update is not disabled by policy, and extend patching to embedded Chromium runtimes (Electron apps, CE Sharpcursor-based tooling) where the vendor ships updated builds.

CVE-2026-20079 — Cisco Secure Firewall Management Center

• Apply the fixed FMC software release from the Cisco Security Advisory for CVE-2026-20079 (https://sec.cloudapps.cisco.com/security/center/publicationListing.x).
• Confirm FMC management interfaces are segmented behind a firewall with management-only ACLs. If your FMC is reachable from the internet, treat it as potentially compromised regardless of patch state.
• Post-patch: audit FMC user accounts, review policy deployment history for unauthorized changes, and validate that logging pipelines from managed FTD devices have not been tampered with.

Cross-cutting actions:

1. Pull the BOD 26-04 due dates from each KEV Catalog entry and track remediation to completion in your vulnerability management platform — KEV deadlines are enforceable for federal agencies and are the de facto SLA for everyone else.
2. Assume breach where patching lags. Any of these appliances that sat unpatched and internet-reachable during the exploitation window warrant a compromise assessment, not just a patch.
3. Feed the KEV into your prioritization engine. If your vulnerability scanner still ranks these below a medium-severity internal finding because of raw CVSS math, your prioritization model is broken. KEV membership overrides CVSS. Full stop.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub