CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog Including Cisco FMC and Fortinet FortiOS
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
One of the flaws, CVE-2026-20079, impacts Cisco Secure Firewall Management Center (FMC) and the cloud-based Security Cloud Control (SCC) service. Attackers can bypass authentication and obtain root privileges by sending a crafted HTTP request. The issue was publicly disclosed on March 4, 2026.
Another vulnerability, CVE-2025-25249, affects Fortinet products including FortiOS and FortiSwitchManager. It is a heap-based buffer overflow that allows execution of unauthorized code or commands through crafted packets. Fortinet published a security advisory in January 2026.
The remaining two vulnerabilities also involve Citrix NetScaler and additional Cisco firewall management products, according to the CISA alert issued on September 9, 2026.
Organizations are strongly advised to review the official CISA KEV catalog and apply available patches without delay to prevent further exploitation.
Related articles
Critical RCE Vulnerabilities Disclosed in Check Point VPN Implementations
Check Point Software Technologies has disclosed multiple critical remote code execution vulnerabilities affecting its Quantum Security Gateway and related VPN components. The issues, tracked as CVE-2026-85102 and CVE-2026-85103, both carry a CVSS v3.1 base score of 9.8 and require no authentication for exploitation under specific conditions. CVE-2026-85102 stems from insufficient certificate validation during VPN negotiation in Remote Access VPN and Site-to-Site VPN setups, allowing attackers to bypass authentication and execute arbitrary code. CVE-2026-85103 involves a heap-based buffer overflow in ASN.1 decoding of VPN certificates, similarly enabling unauthenticated remote code execution. The vendor released a security advisory on September 9, 2026, along with live patches through Check Point Live Patch and official updates for affected products including Quantum Security Management.
10 Non-Obvious S3 Integration Vulnerabilities Exposed in Web Application Bug Bounty Research
Security researcher Sergey Bobrov, known as BlackFan, published a detailed analysis of S3 misconfigurations when integrated into web applications via proxies such as nginx. The article examines ten laboratory setups demonstrating issues ranging from stored XSS and bucket takeover to rewrite rule bypasses and cache poisoning. Key findings highlight how nginx path normalization differences, missing trailing slashes, and variable usage like $uri enable attackers to reach arbitrary buckets or inject HTTP request splitting payloads. The research covers both direct S3 client usage and proxy-based integrations, emphasizing ACL and Bucket Policy errors that expose data to any authenticated S3 user worldwide. Practical demonstrations include exploitation of Ceph RGW path traversal with ../ sequences and cache key collisions via response-content-type parameters. The work provides fingerprinting tables for identifying S3-compatible systems including MinIO, Ceph RGW, and Yandex Cloud based on headers and error responses.
Asset and Vulnerability Management in Practice: Building a Working Process with MaxPatrol VM and NetBox
This detailed guide explains how organizations can implement effective asset and vulnerability management by focusing on reliable infrastructure data, IT collaboration, and automation. It draws from real-world projects using MaxPatrol VM, NetBox, and 1C:ERP to demonstrate dynamic grouping, webhook-driven asset onboarding, and deviation-based control. The approach emphasizes eight core principles including minimizing human dependency, just-in-time awareness, maximum data accuracy, and embedding security into existing IT workflows. Technical flows cover automatic scanning initiation upon asset creation in NetBox, categorization against unacceptable events, and priority-based patching cycles aligned with Patch Tuesday. Self-control mechanisms and PDQL queries enable ongoing validation of subnets, asset freshness, and compliance without excessive manual oversight. The framework is designed to be adaptable to any mature vulnerability management platform beyond the specific tools demonstrated.
Google Releases Chrome 153 Fixing 230 Vulnerabilities Including Zero-Day Exploit
Google has released Chrome 153 for Windows, macOS, and Linux, addressing a total of 230 security vulnerabilities. The update includes fixes for five critical-severity issues and one confirmed zero-day vulnerability already exploited in the wild. Among the critical flaws are use-after-free bugs in WebGL tracked as CVE-2026-87464 and CVE-2026-87488, an out-of-bounds write CVE-2026-87438, a buffer overflow CVE-2026-87527, and a use-after-free in the Cast component identified as CVE-2026-87628. A medium-severity out-of-bounds write in the V8 JavaScript engine, CVE-2026-87491, was reported on August 6, 2026 and has seen active exploitation. The company is rolling out the patches gradually over the coming days and weeks across all supported platforms.