Four Actively Exploited Vulnerabilities Added to CISA KEV Catalog (CVE‑2025‑25249, CVE‑2026‑19490, CVE‑2026‑87491, CVE‑2026‑20079)
What It Is – CISA announced that four CVEs have been placed into its Known Exploited Vulnerabilities (KEV) Catalog after confirming active, real‑world exploitation. The flaws affect Fortinet firewalls, Citrix NetScaler, Google Chromium’s V8 engine, and Cisco Firewall Management Center.
Exploitability – All four are being leveraged in the wild; public exploit code and attacker activity have been observed. CVSS scores range from 8.5 to 9.8, indicating high severity.
Affected Products – Fortinet multiple products (heap‑based buffer overflow), Citrix NetScaler (authentication bypass), Google Chromium V8 (out‑of‑bounds write), Cisco Firewall Management Center (authentication bypass).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management evidence that can be presented in audits or to regulators.
- Highlights how a single unpatched flaw can break the “total control” control objective, undermining the assurance posture across multiple frameworks.
- Shows that rapid remediation, documented in a trusted repository, is now a baseline expectation for federal and enterprise buyers alike.
Recommended Actions
- Identify any of the four CVEs in your asset inventory.
- Prioritize patching per CISA’s BOD 26‑04, capturing remediation tickets as audit evidence.
- Validate the patch status with automated scanning and retain proof of compliance for continuous monitoring.
Source: CISA Advisory – 09 Sep 2026