Two days to patch: what CISA's September deadline tells you

What happened

On September 10, 2026, the US Cybersecurity and Infrastructure Security Agency added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. They affect Cisco Secure Firewall Management Center, Citrix NetScaler and a Fortinet product.

The Cisco flaw, CVE-2026-20079, scores a perfect 10.0. An attacker with no credentials can run code remotely, and no user needs to click anything.

CISA required federal civilian agencies to patch by September 12. That is a two-day window. Deadlines in this catalog usually run a week or two. The short fuse is itself the message.

So what for your business

That deadline binds federal agencies, not you. But a flaw only lands in this catalog because exploitation is already happening, so treat the short window as a signal for everyone.

What these products have in common is their position. Firewalls, management consoles and remote-access gateways sit on the edge and control who gets in. When one of them is the weak point, the usual defenses don't help, because the attacker is already standing on the thing that was supposed to stop them.

A calendar built around monthly patch windows can't absorb this. You need a second, faster lane for the small set of systems where speed matters most.

What to do this month

1. List your edge devices. Firewalls, VPNs, gateways, remote-access tools. Name an owner and a vendor contact for each.
2. Create an emergency lane. For actively exploited flaws on those devices, set a target of days, and decide in advance who can approve it without a meeting.
3. Subscribe to the KEV catalog. Check your list against it each week. It's free and short.
4. Know your fallback. If you can't patch today, restrict who can reach the management interface and isolate the device until you can.
5. Practice once. Run a drill on a non-critical device so the first emergency isn't also the first rehearsal.