--- title: "Security digest: September 9, 2026" url: https://erroneo.us/security/2026-09-09/ description: "September 9, 2026 vulnerability digest: 1 brief (Check Point: Exploited VPN Gateway and…); 4 CISA KEV additions (Cisco, Citrix, Fortinet, Google); 1…" type: security-digest-day section: "Security Digest" date_published: 2026-09-09 date_modified: 2026-09-22 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 9, 2026 1 editorial brief, 4 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Act now: Check Point: Exploited VPN Gateway and Management RCEs . Anyone running Check Point Security Gateways or Spark firewalls with Remote Access VPN or certificate-based Site-to-Site VPN, and anyone running on-prem Security Management, Multi-Domain, Log or SmartEvent servers. - Do you run any of these? Google Chromium V8, Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management, Citrix NetScaler, Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-12. - Maven: 1 critical advisory ( org.freemarker:freemarker ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [Check Point: Exploited VPN Gateway and Management RCEs](https://erroneo.us/security/briefs/check-point-vpn-and-management-cve-2026-85102-93616/index.md): Check Point shops should patch both gateways and management servers now: each flaw is unauthenticated RCE, both are exploited, and fixing one tier does not fix the other. ## Known exploited (CISA KEV) - [CVE-2026-87491](https://erroneo.us/security/cve/CVE-2026-87491/index.md) Google Chromium V8: Google Chromium V8 Out of Bounds Write Vulnerability (CISA due 2026-09-23) - [CVE-2026-20079](https://erroneo.us/security/cve/CVE-2026-20079/index.md) Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability (CISA due 2026-09-12) - [CVE-2026-19490](https://erroneo.us/security/cve/CVE-2026-19490/index.md) Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (CISA due 2026-09-12) - [CVE-2025-25249](https://erroneo.us/security/cve/CVE-2025-25249/index.md) Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability (CISA due 2026-09-12) ## Critical advisories - [CVE-2026-84939](https://erroneo.us/security/cve/CVE-2026-84939/index.md) Apache FreeMarker template loading mechanism vulnerable to path traversal — Maven org.freemarker:freemarker >= 2.2.0, <= 2.3.34 → 2.3.35 --- Source page: https://erroneo.us/security/2026-09-09/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt