The security bulletin of October 5, 2026 highlights new major cyber threats, including vulnerabilities actively exploited in enterprise network equipment and consumer devices, alongside critical breaches in authentication platforms and databases.
Actively Exploited Vulnerabilities
CVE-2026-88779: Citrix NetScaler
A buffer restriction error affects Citrix NetScaler ADC and Citrix NetScaler Gateway, potentially leading to service unavailability (Denial of Service). Details on NVD.
CVE-2026-102490 and CVE-2026-102489: Zammad GmbH Zammad
These two vulnerabilities can be chained by attackers: CVE-2026-102489 allows session fixation to achieve remote code execution (RCE), while CVE-2026-102490 allows local privilege escalation to root level. Details on NVD (CVE-2026-102489) and NVD (CVE-2026-102490).
CVE-2026-104286: Fortinet FortiMail
A path traversal and improper neutralization of NULL character vulnerability allows unauthenticated attackers to write arbitrary files via malicious HTTP/HTTPS requests. Details on NVD.
CVE-2026-76504: Cisco Catalyst SD-WAN Manager
Improper handling of URI encoding in HTTP requests allows an unauthenticated attacker to access the system with administrator privileges. Details on NVD.
CVE-2026-86950: Apple Multiple Products
An out-of-bounds write issue in CoreGraphics affects iOS, macOS, and iPadOS, with the risk of arbitrary code execution. Details on NVD.
New Critical Vulnerabilities
CVE-2026-105134: Ahsay AhsayCBS
An extremely severe error (CVSS 10) in the Replication Receiver component allows OS command injection by manipulating the “random” parameter. Updating to version 10.3.4 is recommended. Details on NVD.
CVE-2026-105135: InternLM MindSearch
A code injection vulnerability with a CVSS score of 10 affects the ExecutionAction.run function in the Planner Agent component (version 0.1.0). Details on NVD.
CVE-2026-105207, CVE-2026-105209, CVE-2026-105215: ZITADEL
Three major vulnerabilities affect the ZITADEL identity platform. These allow takeover of victim accounts through incorrect external identity provider (IdP) mappings or unauthorized generation of enrollment codes. Details on NVD (CVE-2026-105207), NVD (CVE-2026-105209), and NVD (CVE-2026-105215).
From the Security Press
Cyber Threat Actor Warlock Exploits SharePoint Vulnerabilities to Run Ransomware
The Warlock group, suspected of ties to Chinese state actors, actively exploits vulnerabilities in Microsoft SharePoint to compromise government and education institutions in Spanish and Portuguese-speaking regions, aiming to disable security solutions and deliver ransomware. Details on The Hacker News.
Recommendations
- Rigorous Patch Management: Prioritize applying security updates provided by vendors for platforms affected by actively exploited vulnerabilities, especially Citrix, Fortinet, and Apple.
- Web Traffic Monitoring: Monitor web logs to identify path traversal attempts or special characters sent to publicly exposed APIs.
- Identity Configuration Review: If you use identity management solutions such as ZITADEL, make sure to apply patched versions to prevent unauthorized mapping of external accounts.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
