Two Perfect-10 Vulnerabilities Are Being Exploited Right Now — Is Your Patch Window Fast Enough?
Executive Cyber Threat Intelligence Briefing — September 14, 2026 | DataWater Security Intelligence Desk
Executive Summary
Two vulnerabilities hit the maximum possible CVSS score this week — and both are already being exploited. A path traversal flaw in GitLab was weaponized within days of the patch shipping. An authentication bypass in Cisco’s Secure Firewall Management Center has been tied to three separate active intrusion clusters since August.
These are not theoretical risks flagged in a research paper. CISA has confirmed active exploitation on both and forced an emergency federal patch deadline of September 12. If either product sits anywhere in your environment, the question is no longer “when do we patch this” — it’s “are we already compromised.”
What makes this moment different from a routine Patch Tuesday: perfect-10 scores are rare, and having two land in the same week — one in developer infrastructure, one in network perimeter infrastructure — means attackers have simultaneous, high-value paths into both the software supply chain and the network edge.
Threat Snapshot — September 14, 2026
- GitLab — CVE-2026-85706, CVSS 10.0, path traversal in the repository commits API, unauthenticated file read, exploited within days of the September 10 patch
- Cisco Secure FMC — CVE-2026-20079, CVSS 10.0, authentication bypass to root, exploited since August, three distinct post-compromise clusters (UAT-12197, UAT-11823, UAT-11988)
- Citrix NetScaler ADC/Gateway — CVE-2026-19490, CVSS 9.3 authentication bypass, added to the same CISA KEV batch
- Fortinet FortiOS/FortiSwitchManager/FortiSASE — CVE-2025-25249, CVSS 7.3 heap-based buffer overflow, added to the same batch
- CISA federal remediation deadline: September 12, 2026
Why This Matters to CISOs and Security Leaders
A CVSS score of 10.0 means the vulnerability requires no privileges, no user interaction, and delivers full compromise — the ceiling of the scoring system. Getting one such flaw in a widely deployed product is notable. Getting two, in the same week, in products that sit at opposite ends of the enterprise stack — GitLab in the software delivery pipeline, Cisco FMC at the network perimeter — is the kind of coincidence that turns a single week into a board-level incident review regardless of whether your organization was directly hit.
“Perfect-10 scores are rare. Having two land in the same week, one in developer infrastructure and one in network perimeter infrastructure, means attackers have simultaneous, high-value paths into both the software supply chain and the network edge.”
The Biggest Cybersecurity Developments This Week
1. GitLab — CVE-2026-85706 (CVSS 10.0)
GitLab shipped a fix on September 10 for a path traversal vulnerability in the repository commits API, affecting both Community Edition and Enterprise Edition. Under certain conditions, an attacker doesn’t need to authenticate at all to read arbitrary files from a vulnerable GitLab server. CISA added the flaw to its Known Exploited Vulnerabilities catalog within days of the patch landing — meaning attackers moved from patch release to active exploitation faster than most organizations can complete a change-management cycle. What’s exposed: source code, CI/CD pipeline secrets, internal configuration files, and any credentials embedded in repository history or server configuration.
2. Cisco Secure Firewall Management Center — CVE-2026-20079 (CVSS 10.0)
This is an authentication bypass in the web interface of Cisco Secure Firewall Management Center that allows an unauthenticated, remote attacker to bypass login entirely, execute script files on the device, and obtain root access to the underlying operating system. Cisco has confirmed exploitation dating back to August 2026 and has identified three distinct clusters of post-compromise activity — tracked as UAT-12197, UAT-11823, and UAT-11988 — using the flaw to deploy web shells and malware on compromised firewall management consoles. What’s exposed: root-level control of the system that manages your firewall policy — an attacker who owns your FMC effectively owns your perimeter’s rulebook.
3. The Same KEV Batch Bundled Two More Flaws
CISA bundled two related flaws into the same emergency Known Exploited Vulnerabilities batch: a Citrix NetScaler ADC/Gateway authentication bypass (CVSS 9.3) and a Fortinet FortiOS/FortiSwitchManager/FortiSASE heap-based buffer overflow (CVSS 7.3), setting a federal patch deadline of September 12. A single week that bundles a perfect-10 developer-infrastructure flaw, a perfect-10 network-perimeter flaw, and two more high-severity edge-device bugs is not a coincidence CISOs should read past.
Threat Intelligence Breakdown
| Threat | Actor / Source | Enterprise Impact |
|---|---|---|
| GitLab path traversal (CVE-2026-85706) | Unattributed, exploited in the wild within days of patch | Unauthenticated exposure of source code, CI/CD secrets, and repository credentials |
| Cisco Secure FMC auth bypass (CVE-2026-20079) | Three distinct clusters — UAT-12197, UAT-11823, UAT-11988 | Root compromise of firewall management infrastructure, policy tampering, log suppression |
| Citrix NetScaler ADC/Gateway (CVE-2026-19490) | Added to same CISA KEV batch | Authentication bypass on VPN/ICA Proxy/RDP Proxy configurations |
| Fortinet FortiOS/FortiSwitchManager/FortiSASE (CVE-2025-25249) | Added to same CISA KEV batch | Remote code execution via crafted requests |
Why “Three Active Intrusion Clusters” Changes the Calculus
A single opportunistic actor exploiting a new flaw is routine. Three independently tracked clusters exploiting the same Cisco flaw for post-compromise activity — deploying web shells and malware rather than just probing — signals something more organized: multiple actors, or one actor operating multiple infrastructure sets, have already industrialized exploitation of this bug. Cisco routers and firewall management platforms have been a recurring target for sophisticated intrusion sets this year, and this pattern fits that trend rather than breaking from it.
What Security Leaders Should Do Next
- Identify every GitLab and Cisco FMC instance in your environment — including shadow IT, subsidiary environments, and instances managed by third-party vendors or MSPs.
- Patch on an emergency timeline, not the standard cycle. CISA’s federal deadline was September 12 — treat that as the floor, not the target, for your own environment.
- Assume compromise until proven otherwise on internet-facing instances. Given confirmed exploitation dating to August on the Cisco flaw, review logs back to that window for indicators of web shell deployment or unexpected script execution.
- Rotate credentials and secrets stored in or accessible from any exposed GitLab instance, including CI/CD tokens and embedded API keys.
- Review firewall policy and logging configuration on any FMC instance that was internet-facing during the exposure window, since an attacker with root access could have altered rules or disabled audit trails.
- Extend the same urgency to the related Citrix and Fortinet flaws bundled into this week’s KEV batch if those products are present in your environment.
Final Executive Takeaway
Two maximum-severity, actively exploited vulnerabilities landing in the same week — one in the software supply chain, one at the network perimeter — is a rare enough combination to warrant a direct answer to your board: are we exposed, and if so, since when. Patching closes the door. Only a log review tells you whether someone already walked through it.
FAQ
What does a CVSS score of 10.0 actually mean?
10.0 is the maximum possible score on the CVSS scale, reserved for vulnerabilities that require no authentication or user interaction and result in full compromise of confidentiality, integrity, and availability. Both the GitLab and Cisco flaws described here meet that bar.
Is patching enough, or should we assume compromise?
Patching stops new exploitation but does not remove an attacker who already gained access. Given confirmed exploitation dating back to August on the Cisco flaw, security teams should review logs for the exposure window rather than treating a patch alone as remediation.
Which other products were affected in this week’s CISA emergency batch?
Alongside GitLab and Cisco Secure Firewall Management Center, CISA’s related Known Exploited Vulnerabilities additions this week included a Citrix NetScaler ADC/Gateway authentication bypass and a Fortinet FortiOS heap-based buffer overflow.
