On October 3, 2026, the cyber threat landscape highlights an intensification of attacks exploiting vulnerabilities in critical infrastructures, operating systems, and popular web applications. The CyberSec Intelligence team presents the technical analysis of the latest reported risks.
Actively exploited vulnerabilities
Zammad GmbH Zammad – CVE-2026-102490 and CVE-2026-102489
Zammad contains a session fixation vulnerability (CVE-2026-102489) that can lead to remote code execution as the zammad user. This can be correlated with CVE-2026-102490, a privilege misbehavior flaw that allows a local zammad user to escalate their privileges to root. Details are available at CVE-2026-102490 and CVE-2026-102489.
Fortinet FortiMail – CVE-2026-104286
A path traversal vulnerability and improper null character neutralization allows an unauthenticated attacker to write arbitrary files through modified HTTP or HTTPS requests. Additional details at CVE-2026-104286.
Cisco Catalyst SD-WAN Manager – CVE-2026-76504
An error in handling URI encoding in HTTP requests (hex encoding) allows an unauthenticated remote attacker to access the system with administrator privileges. Details at CVE-2026-76504.
Apple Multiple Products – CVE-2026-86950
An out-of-bounds write vulnerability located in CoreGraphics affects iOS, macOS, and iPadOS systems, and can be used for arbitrary code execution. Details at CVE-2026-86950.
Citrix NetScaler – CVE-2026-88772 and CVE-2026-88771
Citrix NetScaler ADC and Gateway products are affected by an input validation vulnerability (CVE-2026-88771), which allows command execution by unauthenticated users, and an improper memory buffer restriction (CVE-2026-88772), which can lead to code execution or DoS attacks. Details at CVE-2026-88771 and CVE-2026-88772.
New critical vulnerabilities
389-ds-base – CVE-2026-86345
Due to the caching of cleartext bytes during StartTLS negotiation, an attacker on the communication path can inject LDAP messages, causing a client application to consider a failed authentication as valid. Details at CVE-2026-86345.
WordPress Plugins – CVE-2026-14378, CVE-2026-19660, CVE-2026-97637, CVE-2026-19652
Critical vulnerabilities have been identified in popular WordPress plugins: authentication bypass in DevKit Pro (CVE-2026-14378), authentication bypass in Divi Membership (CVE-2026-19660) and in JSON API Auth (CVE-2026-97637), as well as privilege escalation in Divi Membership (CVE-2026-19652). Details at CVE-2026-14378, CVE-2026-19660, CVE-2026-97637 and CVE-2026-19652.
H3C CVM – CVE-2023-54405
An unauthenticated file upload vulnerability in the CVM component of the H3C CAS platform allows remote attackers to upload malicious JSP files and execute arbitrary code via the unfiltered token parameter. Details at CVE-2023-54405.
UTMStack – CVE-2026-82041 and CVE-2026-82042
Authentication and authorization mechanisms are targeted: authorization bypass in agent-level command execution by any authenticated user (CVE-2026-82041) and total authentication bypass via a static system key (CVE-2026-82042). Details at CVE-2026-82041 and CVE-2026-82042.
From the security press
GitLab AI Gateway – Code execution on self-hosted servers
A critical vulnerability with a score of 9.9 in GitLab’s AI Gateway allows authorized users to execute arbitrary commands on self-hosted servers. Patches are available in versions 19.2.4, 19.3.2, and 19.4.1. Details at The Hacker News.
Dell CSM – CVE-2026-63688
Dell has released fixes for Container Storage Modules (CSM), patching a critical (CVSS 10.0) missing authentication vulnerability that could grant unauthorized administrative access to Kubernetes nodes. Details at The Hacker News.
ThreatsDay – Analysis of attack vectors based on system logic
The weekly report highlights how attackers exploit seemingly simple system behaviors, such as cache manipulation, AI model inspection, or the use of exposed secrets to access critical data. Details at The Hacker News.
Bitget – Attack based on a zero-day from a third-party vendor
The Bitget trading platform confirmed that a massive cryptocurrency theft worth 387.5 million dollars occurred by exploiting a zero-day breach in an external security service. Details at The Hacker News.
Citrix NetScaler – Active post-exploitation campaign
Attackers are actively exploiting pre-authentication vulnerabilities on Citrix NetScaler servers to install web shells disguised as style sheets (CSS) and obtain superuser privileges. Details at The Hacker News.
What we recommend
- Patch management: Urgently apply official updates provided by Apple, Cisco, Citrix, Dell, Fortinet, and GitLab for the affected products.
- Monitoring WordPress plugins: Update DevKit Pro, Divi Membership, and JSON API Auth plugins to the latest secure versions and limit the exposure of unused modules.
- Auditing authentication keys and credentials: Change passwords, analyze API permissions, and disable the use of static credentials stored in unprotected environment variables.
- Web traffic and log monitoring: Check for unusual HTTP requests attempting path traversal or command injections on UTMStack, FortiMail, and NetScaler interfaces.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
