Two authoritative records score the same flaw 7.4 and 9.8. On Sep 9 CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog, three of them edge kit: CVE-2026-20079, a Cisco Secure Firewall Management Center authentication bypass; CVE-2026-19490, a Citrix NetScaler ADC/Gateway authentication bypass; and CVE-2025-25249, a Fortinet heap-based buffer overflow. Federal civilian agencies had until Sep 12 on all three. Now try to rank them. Fortinet’s own advisory calls the Fortinet flaw high severity and scores it 7.4; NVD scores the same bug 9.8, critical. One flaw, two records, a spread that crosses a severity boundary — and it is the one carrying a documented mass campaign. SOCRadar reported an attack chain delivering a Node.js remote-access trojan named PivotC2: more than 30,000 IP addresses targeted, 178 devices exploited and infected, mainly US entities, with exploitation seen since July 2026. Cisco separately updated its advisory to say it became aware of active exploitation in August, and Cisco Talos published three clusters of post-compromise activity deploying web shells and malware. If two authorities can’t agree on the number, the number is not your sort key.

If you are an MSP, your management plane spent the week on that list. On Sep 8 CISA added CVE-2026-86218 in N-able N-central, in CISA’s own words a static code injection vulnerability “that could allow for pre-authentication remote code execution” — federal due date Sep 11. (No CVSS figure here on purpose: CISA publishes none, N-able’s own advisory rates it 10.0 and NVD rates the same CVE 9.8. Same problem as above.) N-able patched it in N-central 2026.3 Hotfix 4 on Sep 5 and told customers it “has been observed being exploited in the wild,” while its public release notes said there were no confirmations of exploitation in production environments — read both halves. Two details make this worth more than a patch note. Huntress said it opened an investigation after the compromise of a customer’s fully patched N-central production environment on Sep 4, and stated it could not definitively confirm which exploit was used — in part because of limited historical logging available on the appliance. And watchTowr, which reproduced the flaw, made the structural point: N-central is used by MSPs, MSSPs and large IT organizations to manage entire customer estates, so compromising it reaches every connected system downstream. Patch it. Then ask the other question: is that console reachable from the open internet, and is it on anybody’s asset list as such?

CISA quietly re-cut its insider-threat guidance for the way people actually work now. On Sep 9 CISA released an updated Insider Threat Mitigation Guide — new case studies and statistics, a streamlined structure, and new guidance on three things the original barely covered: hybrid and remote work, artificial intelligence, and adverse employee separations. CISA frames it for security and HR professionals and says any organization can use it regardless of security maturity. If you ran the offboarding afternoon a fortnight ago, this is the free companion reading — and the adverse-separation section is the hour worth booking, because that is the departure where the identity list and the exposure list stop being separate problems.

THE EXPOSED EDGE REVIEW — ONE AFTERNOON

1  LIST     four routes, because you have four lists:
             inbound from the firewall NAT rules
             outward from DNS (every domain you own)
             across cloud tenants (public endpoints)
             through vendor consoles (RMM, EDR, backup)
2  TAG      org · prod-or-dev · public-or-internal ·
             server-app-or-device — plus the fifth field
             that decides everything: the NAMED human.
3  CHECK    KEV, by PRODUCT name, not by CVSS score.
             Read the version off the HOST, not the
             dashboard. Dashboards report what they
             were told.
4  RANK     exposed + on KEV beats a higher-scored
             internal finding. Every time.
5  ATTEST   date it, sign it, note what was ADDED and
             REMOVED since last quarter. Then diary the
             next one before you close the laptop.

⚠️ Confirm “public or internal” from OUTSIDE your own network, not from a config page — and only against systems you own or are authorised to test. For anything that was exposed and on KEV before you patched it, record whether you looked for signs it had already been used: patching closes a door, it does not tell you who came through it. If you find evidence of that, follow your incident-response plan and engage counsel and your insurer per its terms. The kit is a review format and a starting point, not managed security or penetration-testing services, and not legal, compliance, or audit advice.

“We patch on severity, which sounds responsible and is the wrong order. The federal government stopped doing it that way in June — their first question is now whether the box can be reached from the internet at all, and the second is whether somebody is already exploiting it in the wild. I want one afternoon to produce the list we have never actually written down: everything of ours that answers the internet, who owns each one, and which of them run something on the known-exploited list today. Best case, I hand you a dated register with nothing open on it. Worst case, we find the forgotten one ourselves — and re-sorting the patch queue costs nothing.”

Pick the honest one, not the aspirational one. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.