CISA Adds Mikrotik Vulnerability to KEV Catalog – 9-25-26

Yesterday, CISA announced that it had added an improper enforcement of behavioral Workflow vulnerability in the Mikrotik RouterOS to their Known Exploited Vulnerabilities (KEV) catalog. CERT-PL announced this vulnerability (along with five others) on September 5th, 2026. Mikrotik released three new versions (here, here, and here) that mitigate the vulnerability on September 3rd, 2026, with further updates released on September 22nd.  

On September 4th, Nick Pratley published a technical analysis of the Mikrotik vulnerability based upon his version differential analysis (using AI tools to speed the analysis); includes a limited effect proof-of-concept code. On September 17th, Bishop Fox published an article describing evidence that the six vulnerabilities were being exploited in the wild before Mikrotik published their updated versions, confirming a similar report from CERT.PL published on September 5th, 2026. 

CISA is requiring federal agencies to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” A compliance deadline of September 28th, 2026, has been established. 

CISA Adds Zyxel Vulnerability to KEV – Catalog – 9-21-26

Today, CISA announced that they had added a stack-based buffer overflow vulnerability in the Zyxel GS1900 series switches to their Known Exploitable Vulnerabilities (KEV) catalog. Zyxel reported the vulnerability on June 16th, 2026. The vulnerability was reported to Zyxel by Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu, and Tianyue Luo from Institute of Software, Chinese Academy of Sciences (ISCAS). 

Today, GreyNoise reported (in an article about a WordPress exploit): 

“In addition to the above findings, GreyNoise discovered the MCA [malicious cyber actor] targeted ZyXEL GS1900 Smart Managed Switches globally with a novel exploit of CVE-2026-7273. As of 17 September 2026, this is the first publicly documented case of exploitation in the wild of this vulnerability, which is also not on [obviously dated before today’s CISA announcement] the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog at the time of publication. The MCA successfully exploited and exfiltrated sensitive data from 996 ZyXEL switches across 48 countries.” 

CISA has directed federal agencies using the affected Zyxel devices to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [Links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” 

A compliance date of September 24th, 2026, has been established. 

CISA Adds 2 MikroTik Vulnerabilities to KEV Catalog – 9-10-26

Yesterday, CISA announced that it was adding two vulnerabilities in the MikroTik OS to their Known Exploited Vulnerabilities (KEV) catalog. The two vulnerabilities are: 

• Missing authentication for critical function - CVE-2026-67277, and 
• Argument injection - CVE-2026-86060 

MikroTik reported both vulnerabilities on September 3rd, 2026. The two vulnerabilities were among six initially reported by Sławomir Rozbicki from CERT Polska, with fixed versions available. CERT Polska subsequently reported active exploitation in the wild on September 5th, citing proof-of-concept code developed by Nick Pratley using version diff analysis. 

Based upon the CERT Polska reports the following vulnerabilities may also end up being added to the KEV catalog: 

• Improper verification of cryptographic signature - CVE-2026-67276, CVE-2026-67278,  
• Improper enforcement of behavioral workflow - CVE-2026-67279, and 
• Path traversal - CVE-2026-67281 

CISA has directed federal agencies using the affected products to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” 

CISA has established a compliance date of September 13th, 2026. 

CISA Adds FortiGuard Vulnerability to KEV Catalog – 9-9-26

Yesterday, CISA announced that it had added a heap-based buffer overflow vulnerability in the FortiGuard FortiOS and FortiSwitchManager products to their Known Exploited Vulnerabilities (KEV) catalog. FortiGuard published their advisory on the vulnerability in January 2026, and most recently updated it in February. Fixed versions are available. 

On Tuesday, SOCRadar published an article detailing their discovery of the “PivotC2, a Node.js Remote Access Trojan (RAT) designed specifically as a FortiGate post-exploitation tool.” They report seeing evidence of exploits in the wild as far back as July of this year. The article provides a detailed technical analysis of the fortirun.bin component of PivotC2 as well as indicators of compromise. 

CISA has directed federal agencies using the affected FortiGuard products to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” 

A compliance deadline of September 12th, 2026 has been established.