Critical KEV Vulnerability on Internet-Facing Asset

A vulnerability listed in CISA's Known Exploited Vulnerabilities catalogue is present on an internet-facing asset, such as the SSL-VPN service on Summit Ridge Auto Group's sr-ford-fw01 FortiGate.

Updated Aug 22, 2026kevvulnerabilityfortinetriskRun in Fix Center

Trigger: A finding matches a CVE present in the CISA KEV catalogue and the affected asset has an internet-facing interface or service.
Risk: KEV entries are being actively exploited in the wild. Combined with internet exposure, AssurIQ Risk weights this well above a CVSS score alone — severity, EPSS, KEV status, exposure and asset criticality all compound. An unpatched sr-ford-fw01 SSL-VPN is a plausible initial-access path into the whole Summit Ridge network.

Prerequisites

Confirm the CVE is genuinely listed in the CISA KEV catalogue, not just a high-CVSS finding
Identify an out-of-band management path to the firewall that does not depend on the vulnerable service
Confirm current firmware version and the target fixed version from the vendor advisory
Schedule or invoke an emergency maintenance window with the customer

Recommended fix

Confirm KEV status and due date directly against the CISA KEV catalogue entry for the CVE, and record the catalogue reference as evidence.
Isolate exposure immediately: restrict or disable public access to the vulnerable management/SSL-VPN interface while the fix is prepared, using an out-of-band access path for the firewall itself.
Open a maintenance window and notify the customer that a firmware upgrade is required to remediate an actively exploited vulnerability.
Stage the target firmware version and change plan, including a rollback image, before starting the upgrade.
Apply the firmware upgrade to sr-ford-fw01 as a canary: upgrade during the maintenance window, then hold before re-enabling public access.
Re-enable the SSL-VPN or management interface only after the upgrade completes and a post-upgrade health check passes.
Re-scan the asset and, where the exposure was internet-facing, confirm remediation from an external vantage point as well as internally.
Record evidence of the fixed version and re-scan result, and update the AIQ-VM-001 control result to reflect the resolved KEV exposure.

Validation

Vulnerability re-scan no longer reports the CVE against sr-ford-fw01
An external scan or reachability check confirms the previously exposed service now runs the patched version
AIQ-VM-001 control history shows a transition out of FAIL with the new evidence attached
No new critical findings were introduced by the firmware change

Rollback and recovery

If the upgrade fails health checks, restore the staged rollback firmware image and re-verify basic connectivity before ending the maintenance window.
If rollback is used, the KEV exposure remains open — re-open the remediation item and re-notify the customer with a revised plan.
Confirm the management/SSL-VPN interface stays restricted until a working fixed version is deployed.

Evidence generated

CISA KEV catalogue reference and due date captured at time of remediation
Pre- and post-change firmware version records
Internal and external re-scan results showing the CVE is resolved
Maintenance window record with authorization and timing
Updated AIQ-VM-001 control observation with linked evidence