CISA Adds FortiGuard Vulnerability to KEV Catalog – 9-9-26

Yesterday, CISA announced that it had added a heap-based buffer overflow vulnerability in the FortiGuard FortiOS and FortiSwitchManager products to their Known Exploited Vulnerabilities (KEV) catalog. FortiGuard published their advisory on the vulnerability in January 2026, and most recently updated it in February. Fixed versions are available. 

On Tuesday, SOCRadar published an article detailing their discovery of the “PivotC2, a Node.js Remote Access Trojan (RAT) designed specifically as a FortiGate post-exploitation tool.” They report seeing evidence of exploits in the wild as far back as July of this year. The article provides a detailed technical analysis of the fortirun.bin component of PivotC2 as well as indicators of compromise. 

CISA has directed federal agencies using the affected FortiGuard products to apply “mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements” [links added]. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.” 

A compliance deadline of September 12th, 2026 has been established. 

Short Takes – 9-10-26 - Federal Register Edition

HAZMAT Safety  

Hazardous Materials: California's Reusability Mandate for Propane Cylinders. PHMSA preemption notification notice. Summary: “The Federal Hazardous Materials Transportation Act (HMTA), 49 U.S.C. 5101 et seq., preempts California's reusability mandate for propane cylinders in California Public Resources Code, Sections 42395-42395.2. The reusability mandate imposes localized design and manufacturing requirements on a container that is represented, marked, certified, or sold as qualified for use in the transportation of a hazardous material—specifically, propane—that are not substantively the same as the requirements in the HMR. The reusability mandate is also an obstacle to accomplishing and carrying out the HMTA. By banning a federally authorized, safety-compliant packaging based on localized waste management preferences, California creates a fragmented regulatory patchwork that undermines the primacy and uniformity of the Federal transportation safety framework.” 

Information Collection Requests  

Proposed Renewal Collection and Request for Comment; Regulation of Persistent, Bioaccumulative, and Toxic Chemicals Under TSCA Section 6(h). EPA 60-day ICR renewal notice. 

Proposed Renewal Collection and Request for Comment; User Fees for the Administration of the Toxic Substances Control Act (TSCA). EPA 60-day ICR renewal notice. 

State, Local, Tribal and Private Sector (SLTPS) Clearance Request Form (Form 9014) Submission to the Office of Management and Budget for Review and Approval; Comment Request. CISA 60-day ICR revision notice. 

Executive Orders  

EO 14424 - Promoting Fair Competition in Livestock Markets and Expanding Market Access for American Meat Producers. 

EO 14425 - Supporting America's Ranchers. 

Short Takes – 9-9-26 - Federal Register Edition

Grid Security  

Securing the United States Bulk-Power System. CESER request for information. Summary: “Consistent with the Executive order of August 26, 2026, Declaring a National Emergency to Secure the United States Bulk-Power System [EO 14421], the Department of Energy (DOE or the Department) is seeking information from industry and other stakeholders to inform DOE actions to implement the Executive order. Specifically, DOE seeks information regarding the scope of covered equipment and transactions; risks associated with Covered Foreign Entities and foreign-produced bulk-power system electric equipment; supply chain, software, firmware, digital service, maintenance service, and remote-access practices; existing equipment and potential mitigation; licensing and prequalification; domestic manufacturing and secure replacement capacity; Federal procurement; and potential economic, reliability, safety, and small-entity impacts.” 

Highway Safety  

Agency Information Collection Activities; Renewal of an Approved Information Collection: Accident Recordkeeping Requirements. FMCSA 60-day ICR renewal notice. Summary: “This ICR relates to Agency requirements that motor carriers maintain a record of accidents involving their commercial motor vehicles (CMVs). Motor carriers are not required to report this data to FMCSA, but must produce it upon inquiry by authorized Federal, State or local officials.” 

HAZMAT Safety  

Hazardous Materials: Notice of Administrative Determination of Preemption for Common Law Tort Claims Concerning the Transportation of Gasoline. PHMSA notice of preemption decision. Summary: “The Exxon Mobil Corporation (Exxon) seeks a determination that Federal law preempts State common law claims brought against it in New Jersey concerning the safe transportation of gasoline in commerce. PHMSA is issuing a final administrative determination concluding that the State common law tort claims presented by Exxon are preempted. Each of these duties, if imposed, would present an obstacle to compliance with the Federal regulatory framework essential for the safe transportation of gasoline. In addition, any claims about covered subjects, such as the marking, loading and unloading, and classification of gasoline that are not substantively the same as the applicable HMR provisions are preempted.” 

Space Geek  

Unleashing Unlicensed Spectrum for Direct-to-Device. FCC notice of proposed rulemaking. Summary: “The Federal Communications Commission (Commission or FCC) issues a Notice of Proposed Rulemaking proposes to expand opportunities for direct-to-device (D2D) communications by permitting certain unlicensed devices to communicate with satellites on a non-interference basis. Building on recent market growth and new industry investment in D2D technologies, the NPRM explores adding satellite allocations in specific unlicensed bands, clarifying that equipment may operate within spacecraft, and establishing a flexible regulatory framework that preserves incumbent operations while enabling continued innovation. The Commission seeks comment on technical, licensing, and policy considerations to support expanded D2D connectivity and ensure coexistence with existing services.” 

OMB Approves FCC Satellite Spectrum Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the Federal Communications Commission (FCC) on “Satellite Spectrum Abundance (SB Docket No. 25-180)”. The FCC published the notice of proposed rulemaking for this action in June 2025. The final rule was sent to OIRA on August 20th, 2026. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“On May 22, 2025, the Commission adopted a Notice of Proposed Rulemaking to seek further comment on ways to use the 12.7-13.25 GHz band (12.7 GHz band) and the 42.0-42.5 GHz band (42 GHz band) more efficiently and intensively. Specifically, the item seeks comment on the possibility of achieving more intensive use of the 12.7 GHz band by satellite communications through the removal of existing regulatory restrictions and the opening of the band to a wider range of satellite operations. Likewise, it seeks comment on the potential for more intensive use of the 42 GHz band by adding for the first time an allocation for fixed-satellite service (FSS). In both instances, the item seeks comment on ways to protect any incumbent spectrum users in the bands, as well as ways to protect spectrum users, particularly Federal operators, in adjacent bands.” 

This rulemaking will not be covered in any detail in this blog; under my limited Space Geek coverage I expect to announce its publication in the appropriate Short Takes post. 

GAO Publishes Report on Chemical Plant Personnel Screening

Today, the Government Accountability Office (GAO) announced the publication of their report on “Chemical Security: DHS Should Provide Options for Voluntary Vetting of Facility Personnel for Terrorist Ties”. GAO was asked to evaluate the effects of the end of the CFATS program in 2023 and the decline in CISA chemical security staffing since 2025 on chemical facility security.  

The report noted that (pg 5): 

“According to CISA officials and representatives from the private sector coordinating council, the three selected chemical associations, and the six selected chemical companies we interviewed, losing the Personnel Surety Program is the most significant challenge high-risk chemical facility owners and operators have faced following the discontinuation of the CFATS program. CISA officials also stated that discontinuing the Personnel Surety Program left a gap in chemical facility security that poses significant risks.” 

The Report made one recommendation (pg 16): 

“Identify, evaluate, and implement voluntary options for chemical facility owners and operators to address insider terrorist security risks by vetting their personnel and unescorted visitors with access to restricted areas or critical assets, and, if necessary, seek the legislative authority to do so.” 

The official CISA response to the recommendation (pg 16): 

“The voluntary collection and handling of sensitive personal information necessary to conduct such vetting would raise significant legal, privacy, compliance, and resource considerations. These considerations include proper collection, use, maintenance, and protection of sensitive personal information necessary to support such activities, as well as requirements associated with safeguarding personal data and providing appropriate redress”