TL;DR
CISA added five new CVEs to its Known Exploited Vulnerabilities catalog this week — three with a 72-hour remediation deadline (September 18) and two due September 21. The KEV catalog is CISA’s way of saying “these are being exploited right now, federal agencies need to patch or mitigate them within the deadline.” For the private sector, it’s a prioritization signal: if an agency with your stack is on the clock, you should be too. Three of the five map to software in our catalog.
What’s in this batch
CISA typically gives 28-30 days for KEV remediation. This batch’s unusually tight deadlines reflect active, accelerating exploitation:
| CVE | Product | Deadline | Why interesting |
|---|---|---|---|
| CVE-2026-XXXXX | Palo Alto PAN-OS | Sep 18 | Firewall management plane RCE, KEV signal + active exploitation |
| CVE-2026-XXXXX | Fortinet FortiOS | Sep 18 | SSL-VPN authentication bypass, ransomware operator interest |
| CVE-2026-XXXXX | Citrix Netscaler ADC | Sep 18 | Path traversal, exploited in supply-chain attacks |
| CVE-2026-XXXXX | Ivanti Connect Secure | Sep 21 | Auth bypass on a widely-used VPN gateway |
| CVE-2026-XXXXX | Zyxel USG FLEX | Sep 21 | Command injection in the management interface |
The first three are the ones that matter for our stack (Palo Alto, Fortinet, Netscaler). The other two round out the batch with enterprise VPN and SMB firewall exposure.
The 72-hour signal
A 72-hour KEV deadline is relatively rare. CISA usually assigns 14-30 days. The shorter deadlines are reserved for vulnerabilities where:
- Exploitation is accelerating. The window between first observed exploit and widespread deployment is shrinking — threat actors are sharing PoCs and modules simultaneously across GitHub, Exploit-DB, and Metasploit.
- The blast radius is broad. These aren’t niche components. They sit in the network perimeter (firewalls, VPN gateways) and when compromised, give attackers lateral access to everything behind them.
- Workarounds exist but are non-trivial. The fixes are in place, but applying them may require maintenance windows, config changes, or service restarts that can’t happen instantly.
What to do
- Check your perimeter stack. Palo Alto PAN-OS, Fortinet FortiOS SSL-VPN, Netscaler ADC — are any of these running vulnerable builds?
- Prioritize the Sep 18 items. If you have Palo Alto, Fortinet, or Netscaler on the internet-facing edge, patch or apply the vendor workaround before Monday.
- Don’t wait for the deadline. CISA’s deadline is a federal SLA. The private sector should treat it as a target, not a hard stop. By the time the deadline hits, the exploit module will likely be in Metasploit.
- Check the vendor portals. Palo Alto Networks, Fortinet, and Citrix have all published advisory pages with affected versions and workarounds. Match your build numbers against those lists.
The broader pattern
This batch follows a consistent theme: perimeter components getting KEV’d. Firewalls, VPN gateways, and reverse proxies are the components that sit at the edge — the first thing an attacker hits and the last thing they lose. When these get patched, the whole org benefits. When they don’t, the attacker gets a foothold that usually lasts for weeks.
The 72-hour deadlines are a signal that the threat landscape is accelerating. The gap between “first exploit observed” and “widely exploited” is shrinking from months to weeks for perimeter components. If your patching cadence is monthly or quarterly, you’re already behind the curve on this batch.