CISA’s Known Exploited Vulnerabilities (KEV) Catalog saw a significant two-day update on September 8 and September 9, 2026, with eight vulnerabilities added based on evidence of active exploitation.
The interesting part is not simply the number eight.
The affected technologies sit directly in the enterprise attack path — e-commerce platforms, remote-management infrastructure, Windows endpoints, firewalls, security management consoles, network gateways and web browsers.
That makes this a particularly relevant KEV update for vulnerability-management and CISO teams.
September 8 — Four vulnerabilities
CISA added four vulnerabilities on September 8. Its alert explicitly identifies the four entries and notes that they were added because of evidence of active exploitation.
CVE-2026-75650 — Adobe Commerce / Magento
Vulnerability: Template-engine injection
CVSS: 10.0 Critical
Impact: Arbitrary code execution
This is one of the most serious vulnerabilities in the batch.
An attacker can exploit the flaw to execute arbitrary code in affected Adobe Commerce and Magento environments. CISA’s catalog also flags this entry for forensic triage and sets a federal remediation deadline of September 11, 2026.
For organizations running internet-facing commerce platforms, this should be treated as an immediate exposure-management issue, not simply another application patch.
CVE-2026-86218 — N-able N-central
Vulnerability: Static code injection
Impact: Pre-authentication remote code execution
This one deserves particular attention from managed-service and enterprise IT environments.
The vulnerability allows an unauthenticated attacker to achieve remote code execution against vulnerable N-central installations. CISA requires forensic triage and gives FCEB agencies until September 11 to remediate.
The risk is amplified because N-central is not merely another server application. It is used for remote monitoring and management, potentially giving an attacker a pathway into downstream managed systems.
CVE-2026-81963 — Microsoft Windows
Vulnerability: Link-following vulnerability
Impact: Local privilege escalation to SYSTEM
The vulnerability exists in the Windows Update Stack and can allow an authorized local attacker to escalate privileges to SYSTEM.
CISA added it on September 8 with a remediation deadline of September 22.
This is a classic example of why a vulnerability does not need to provide initial access to be dangerous.
An attacker who already has a foothold can use privilege escalation to move from a limited user context toward complete control of the endpoint.
CVE-2026-85880 — Microsoft Windows
Vulnerability: Heap-based buffer overflow in Windows ALPC
CVSS: 7.8
Impact: Local privilege escalation
The second Windows entry involves the Windows Advanced Local Procedure Call (ALPC) mechanism.
Like CVE-2026-81963, the practical concern is privilege escalation following initial compromise. CISA lists a September 22 remediation deadline.
Together, the two Windows additions are particularly relevant because they landed alongside Microsoft’s September Patch Tuesday release and were reported as being exploited in the wild.
September 9 — Four more vulnerabilities
September 9 continued the momentum with another four KEV additions.
And this is where the update becomes particularly interesting.
The vulnerabilities move from endpoints and applications into security infrastructure itself.
CVE-2025-25249 — Fortinet
Product: FortiOS / FortiSwitchManager / FortiSASE
Vulnerability: Heap-based buffer overflow
CVSS: 8.1
Impact: Unauthorized code or command execution
The vulnerability affects the cw_acd daemon in Fortinet products and can allow a remote unauthenticated attacker to execute code or commands using specially crafted requests.
This is especially significant because Fortinet edge infrastructure is frequently internet-facing.
More importantly, exploitation research published around the KEV addition reported attackers using the vulnerability to deploy PivotC2, a post-exploitation RAT designed for FortiGate environments.
That changes the conversation from:
“Is the firewall vulnerable?”
to:
“Has the firewall already been compromised?”
CVE-2026-20079 — Cisco Secure Firewall Management Center
Product: Cisco Secure Firewall Management Center (FMC)
CVSS: 10.0 Critical
Vulnerability: Authentication bypass
Impact: Unauthenticated remote root access
This may be the most strategically important vulnerability in the September 9 batch.
An unauthenticated remote attacker can bypass authentication through the FMC web interface and execute scripts to obtain root access to the underlying operating system. Cisco rates the vulnerability 10.0 Critical and states that there is no workaround.
Cisco Talos also reported on September 9 that it was actively tracking exploitation of this vulnerability.
The key risk is architectural:
FMC is a security-management platform.
Compromise of the management plane can potentially provide an attacker with visibility and control over the security infrastructure protecting the broader environment.
That makes this considerably more consequential than an ordinary application vulnerability.
CVE-2026-19490 — Citrix NetScaler ADC / Gateway
Vulnerability: Authentication bypass via alternate path/channel
CVSS: 9.3
Impact: Unauthorized access
The vulnerability affects Citrix NetScaler ADC and NetScaler Gateway when configured for Gateway or AAA functionality.
An unauthenticated remote attacker can exploit an alternate path to bypass authentication. Citrix’s affected versions include NetScaler ADC/Gateway 14.1 versions before 14.1-73.32 and 13.1 versions before 13.1-63.21.
CISA’s addition is significant because NetScaler sits directly at the remote-access perimeter for many enterprises.
This is also worth distinguishing from CVE-2026-8452, the other NetScaler vulnerability that CISA added on August 26. They are different vulnerabilities and require different fixed builds.
CVE-2026-87491 — Google Chromium V8
Product: Chromium / Chrome
Vulnerability: Out-of-bounds write in V8
CVSS: 8.8
Impact: Remote code execution
The final September 9 addition affects Chromium’s V8 JavaScript engine.
A maliciously crafted HTML page can trigger the vulnerability and potentially allow remote code execution. The issue is particularly important because Chromium technology is used not only by Chrome but also by other Chromium-based browsers.
CISA recorded the vulnerability as a KEV entry on September 9, while Google disclosed that it was being exploited in the wild.
This makes browser patching part of the immediate response, particularly for privileged users and high-value endpoints.
The bigger picture
What makes this two-day KEV update notable is the attack-path coverage.
It isn’t eight random vulnerabilities.
It touches almost every major layer:
Internet-facing application → remote management → endpoint privilege escalation → firewall → security-management plane → remote-access gateway → browser
And that creates several potential attack chains.
The enterprise attack path
An attacker could potentially:
Gain initial access
↓
Exploit an internet-facing application or gateway
↓
Establish persistence
↓
Escalate privileges on Windows
↓
Move laterally
↓
Target security-management infrastructure
The Fortinet and Cisco additions are particularly uncomfortable because they involve security infrastructure itself.
If the security control plane is compromised, the organization can potentially lose visibility at exactly the point when it needs it most.
What CISOs should do now
The response should not be:
“Patch all eight.”
It should be:
- Identify internet-facing exposure first
Immediately inventory:
Adobe Commerce / Magento
N-able N-central
Fortinet appliances
Cisco FMC
Citrix NetScaler ADC/Gateway
Chromium-based browsers
- Prioritize the control plane
Give special priority to:
Fortinet → Cisco FMC → Citrix NetScaler → N-central
These systems can sit at strategic points in the enterprise architecture.
- Hunt before closing the ticket
For KEV vulnerabilities involving remote access, firewalls, management platforms and RCE, patching alone is not necessarily sufficient.
Ask:
Was the vulnerable service internet-facing?
For how long?
Were exploitation attempts observed?
Were unexpected accounts created?
Were configuration changes made?
Were new processes or scripts executed?
Did the appliance communicate with unusual external infrastructure?
- Treat KEV as an exploitation signal
CISA’s KEV catalog is specifically intended to identify vulnerabilities with evidence of exploitation. CISA’s BOD 26-04 also emphasizes risk-based remediation and, where applicable, forensic triage.
So the operational workflow should be:
Discover → Validate exposure → Patch/Mitigate → Hunt → Confirm → Close
—not simply:
Scan → Patch → Close
The real message for security leaders is therefore not “eight vulnerabilities were added.”
It is:
Attackers are actively targeting the infrastructure organizations depend on to provide access, manage systems and enforce security.
That is why this two-day KEV update deserves immediate vulnerability-management attention and compromise assessment, especially for internet-facing and security-management assets.
