The security analysis from October 4, 2026 highlights intense exploitation activity of vulnerabilities registered in the CISA KEV catalog, affecting products from Citrix, Fortinet, Cisco, and Apple. High-severity flaws have also been reported in monitoring utilities and cloud platforms, requiring immediate attention.
Actively Exploited Vulnerabilities
Zammad (CVE-2026-102490 and CVE-2026-102489)
Zammad GmbH Zammad is affected by two vulnerabilities that can be chained by attackers. CVE-2026-102489 represents a session fixation issue that can lead to remote code execution under the privileges of the “zammad” user. This can be chained with CVE-2026-102490, a privilege mismanagement vulnerability that allows the local “zammad” user to escalate privileges to root. Details are available on the NVD website for CVE-2026-102489 and CVE-2026-102490.
Fortinet FortiMail (CVE-2026-104286)
The Fortinet FortiMail solution contains a path traversal vulnerability and incorrect neutralization of NULL byte characters. This allows an unauthenticated attacker to write arbitrary files to the underlying system via modified HTTP or HTTPS requests. Source: CVE-2026-104286.
Cisco Catalyst SD-WAN Manager (CVE-2026-76504)
A hex encoding vulnerability in Cisco Catalyst SD-WAN Manager allows an unauthenticated, remote attacker to gain access to the system with administrator (admin) privileges. The flaw is caused by improper processing of URI encoding in HTTP requests. Source: CVE-2026-76504.
Apple (CVE-2026-86950)
Apple iOS, macOS, and iPadOS operating systems are affected by an out-of-bounds write vulnerability in the CoreGraphics component, facilitating arbitrary code execution. Source: CVE-2026-86950.
Citrix NetScaler (CVE-2026-88772 and CVE-2026-88771)
Citrix NetScaler ADC and NetScaler Gateway present two major flaws. CVE-2026-88771 represents improper input validation, allowing an attacker to run arbitrary commands without authentication. CVE-2026-88772 consists of improper restriction of operations within the bounds of a memory buffer, which can lead to code execution or Denial of Service (DoS) attacks. Details at CVE-2026-88771 and CVE-2026-88772.
New Critical Vulnerabilities
H3C Cloud Virtualization Management (CVE-2023-54405)
The H3C CAS cloud platform, through its CVM virtualization management component, contains a critical vulnerability (CVSS score 9.8) that allows unauthenticated file upload in the /cas/fileUpload/upload endpoint. By manipulating the token parameter (path traversal), attackers can upload malicious JSP files into active web directories to execute code as the web server user. Source: CVE-2023-54405.
UTMStack (CVE-2026-82041 and CVE-2026-82042)
UTMStack, in versions prior to 11.2.16, is affected by two severe vulnerabilities. CVE-2026-82041 (CVSS score 9.9) involves a lack of proper authorization in UTMIncidentCommandWebsocket.processCommand(), allowing any authenticated user to send arbitrary OS commands via gRPC to connected agents, running as root or SYSTEM. Additionally, CVE-2026-82042 (CVSS score 9.8) allows authentication bypass and obtaining administrative access to the API by providing a valid Utm-Internal-Key header. Source: CVE-2026-82041 and CVE-2026-82042.
From the Security Press
Warlock Group Targets SharePoint Vulnerabilities
The China-associated threat actor known as Warlock continues to exploit vulnerabilities in Microsoft SharePoint to compromise government, educational, and critical infrastructures in Spanish- and Portuguese-speaking countries, aiming to disable security tools and deliver ransomware. Source: The Hacker News.
GitLab Patches Critical Flaw in AI Gateway
A critical severity vulnerability (score 9.9) has been identified in the AI Gateway component of GitLab. The flaw allows authenticated users who possess Duo Agent Platform access to execute commands on the self-hosted gateway under certain circumstances. Patches have been integrated into gateway versions 19.2.4, 19.3.2, and 19.4.1. Source: The Hacker News.
Dell Container Storage Modules (CVE-2026-63688)
Dell has released security fixes for multiple flaws in Dell Container Storage Modules (CSM), including CVE-2026-63688 (CVSS score 10.0). This represents a lack of authentication for a critical function in the gRPC server csm-authorization-storage, which can lead to unauthenticated administrator access and obtaining root privileges on affected Kubernetes nodes. Source: The Hacker News.
Recommendations
- Patch Management: Urgently update affected Citrix NetScaler, Fortinet FortiMail, Cisco Catalyst solutions, and Apple devices, prioritizing vulnerabilities already under active exploitation (KEV).
- Securing Software Components and APIs: Update UTMStack to version 11.2.16 or higher to eliminate bypass and command execution risks, and apply GitLab AI Gateway and Dell CSM patches if you manage self-hosted or Kubernetes instances.
- Network Activity Monitoring and Auditing: Implement strict monitoring rules for unusual gRPC connections, verify file integrity on web servers (especially publicly accessible directories), and analyze logs to identify potential abuse of internal authentication keys.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
