Is your office firewall or router on CISA’s exploited list?

Why this matters for a small office

The box that connects your office to the internet sees every email, payment and file that leaves the building. When a flaw in it makes CISA’s Known Exploited Vulnerabilities list, attackers are already scanning the internet for that model. Small offices tend to have these boxes installed by whoever set up the internet years ago, and the firmware hasn’t been updated since.

Here is what CISA added from August 1 through October 22, 2026, for the brands we see most in small businesses around here. You can search all of them in our vulnerability database.

Fortinet (FortiGate and friends)

• CVE-2025-25249, added Sept 9: a buffer overflow in FortiOS (the software on FortiGate firewalls), FortiSwitchManager and FortiSASE that lets an attacker run code using specially crafted network traffic.
• CVE-2025-61624, added Oct 16: a path traversal in FortiOS, FortiProxy, FortiPAM and FortiSwitchManager that lets someone with an admin login write or delete files on the device.
• CVE-2026-104286, added Oct 1: a path traversal in FortiMail, Fortinet’s email security appliance.

MikroTik, Zyxel and SonicWall

• MikroTik RouterOS: three entries in September (CVE-2026-67277, CVE-2026-67279 and CVE-2026-86060). CISA notes that two can be chained so an attacker with no login ends up with elevated control of the router.
• Zyxel GS1900 switches (CVE-2026-7273, added Sept 21): someone already on your office network can send one crafted web request and potentially run commands on the switch, no login needed.
• SonicWall SMA1000 remote-access appliances (CVE-2026-83548 and CVE-2026-83549, added Sept 2): one lets the box be used to reach other systems, the other lets an admin-level login run commands on the device.

Cisco

• CVE-2026-20349, added Aug 11: Cisco ASA and Firepower Threat Defense firewalls can be forced to reboot by an attacker with no login, knocking the office offline.
• CVE-2026-20079, added Sept 9: an authentication bypass in Cisco’s Firewall Management Center.
• Two Cisco Secure Email Gateway flaws (Sept 14 and Oct 14) and entries for Identity Services Engine and Catalyst SD-WAN Manager, which show up more in larger offices.

How to check your own office

1. Find out what you haveLook at the box your internet line plugs into, and any firewall or switch next to it. Write down the brand and model. If your internet provider supplied it, ask them who keeps it updated.
2. Check the firmware versionLog in to its admin page (or ask whoever installed it) and compare the firmware version with the maker’s current release. Fortinet, SonicWall, MikroTik, Zyxel and Cisco all publish security advisories by model.
3. Turn on automatic updates where the device offers themMany current firewalls can update themselves. It is often switched off at install.
4. Close the admin page to the internetThe device’s management page should only be reachable from inside the office or over a VPN. Several of these flaws need access to that page to work.
5. Protect the VPNIf staff connect from home, make sure the VPN requires a second factor (a code from an app), not just a password.

If you’re not sure what’s in your network closet, or you think one of these boxes was already used to get in, our incident response team handles web, domain and email incidents and can tell you who to call for the rest.

Sources

• CISA Known Exploited Vulnerabilities catalog
• Our vulnerability database: exploited network flaws