CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026. The vulnerabilities are listed below - CVE-2026-20079 (CVSS score: 10.0) - An authentication

Report facts: CISA has added newly exploited vulnerabilities in Cisco, Citrix, and Fortinet products to its Known Exploited Vulnerabilities catalog and mandated that U.S. Federal Civilian Executive Branch agencies patch these flaws by September 12, 2026. These issues, including at least one CVE with a CVSS score of 10.0, affect widely deployed network and security infrastructure. RealGround analysis: Because many AI systems depend on these vendors’ appliances and services for secure connectivity and perimeter defense, exploited flaws in this infrastructure represent an AI supply chain exposure that can enable lateral movement into AI environments. Organizations should treat such KEV-listed vulnerabilities as critical dependencies in their AI supply chain, updating SBOMs, validating patch compliance across AI-related networks, and assessing whether any AI workloads could be reached or tampered with via these compromised components.