CyberSec Intelligence presents the daily cybersecurity bulletin for October 6, 2026. It includes a synthesis of vulnerabilities actively exploited in real-world conditions, newly identified critical breaches, and an overview of the main news from the specialized press.
Actively Exploited Vulnerabilities
CVE-2026-88779 – Citrix NetScaler
An “Improper Restriction of Operations within the Bounds of a Memory Buffer” vulnerability affects Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). This can be exploited to cause a Denial of Service (DoS) state. Source: NVD CVE-2026-88779.
CVE-2026-102490 and CVE-2026-102489 – Zammad GmbH Zammad
Zammad is affected by two vulnerabilities that can be combined in an attack chain (chaining). CVE-2026-102489 is a Session Fixation vulnerability that can lead to remote code execution (RCE) as the “zammad” user. This can be combined with CVE-2026-102490, an improper privilege management vulnerability that allows a local zammad user to escalate their privileges to root. Source: NVD CVE-2026-102490 and NVD CVE-2026-102489.
CVE-2026-104286 – Fortinet FortiMail
A Path Traversal and improper neutralization of NULL character vulnerability allows an unauthenticated attacker to write arbitrary files on the underlying system via specially crafted HTTP or HTTPS requests. Source: NVD CVE-2026-104286.
CVE-2026-76504 – Cisco Catalyst SD-WAN Manager
A Hex Encoding vulnerability, caused by improper handling of URI encoding in HTTP requests, allows an unauthenticated remote attacker to access the affected system with administrator privileges. Source: NVD CVE-2026-76504.
CVE-2026-86950 – Apple (iOS, macOS, iPadOS)
An Out-of-Bounds Write vulnerability identified in the CoreGraphics component can be exploited to achieve arbitrary code execution. Source: NVD CVE-2026-86950.
New Critical Vulnerabilities
CVE-2026-105135 – InternLM MindSearch (CVSS 10)
A Code Injection vulnerability affects the ExecutionAction.run function in the mindsearch/agent/graph.py file of the Planner Agent component in InternLM MindSearch version 0.1.0. Tampering with remote input arguments allows code injection. Source: NVD CVE-2026-105135.
CVE-2026-105207 – ZITADEL (CVSS 9.8)
In versions 3.0.0 through 3.4.15 and 4.0.0 prior to 4.17.3, the platform allows linking user accounts with external identity providers without verification of a primary factor or caller privileges. An unauthenticated attacker who knows a victim’s username can associate their own external IdP account with the victim’s account to authenticate on their behalf. Source: NVD CVE-2026-105207.
CVE-2026-105484 – TOTOLINK X6000R (CVSS 10)
A Command Injection vulnerability affects the firmware_check function in the firmware upload component (file /cgi-bin/cstecgi.cgi) on TOTOLINK X6000R devices (version 9.4.0cu.652_B20230116). The attack can be executed remotely by manipulating the file_name argument. Source: NVD CVE-2026-105484.
From the Security Press
Weekly Recap: Zero-days in NetScaler and FortiMail
The weekly report highlights how small details escape administrators’ attention (exposed public repositories, misconfigurations) and become footholds for attackers. This week highlighted the active exploitation of flaws in NetScaler and FortiMail, reflecting an increase in the technical capabilities of the attacks. Source: The Hacker News.
Realtek Jungle SDK Exploit Delivers Cling Botnet
Active attempts to exploit a patched vulnerability in the Realtek Jungle SDK software package are registered, aiming to distribute the Cling malware. This is remarkable because it reuses standard STUN behavior as a command and control (C2) channel. Source: The Hacker News.
CVE-2026-61500 – Active Attacks on Rejetto HFS
A critical vulnerability (CVSS 9.3) in Rejetto HTTP File Server (HFS) allows session hijacking due to the use of a weak pseudo-random number generator (PRNG). The flaw provides attackers with the opportunity to obtain unauthorized administrative access and remote code execution. Source: The Hacker News.
What We Recommend
To protect your company’s networks and information systems, CyberSec Intelligence specialists recommend implementing the following measures:
- Rigorous patch management (Patch Management): Prioritize applying official security updates released by vendors to remediate vulnerabilities in Citrix, Fortinet, Cisco, Apple, and TOTOLINK products.
- Software and hardware asset inventory: Maintain a clear inventory of the technologies used in the organization to quickly detect and isolate systems or applications (such as Zammad, ZITADEL, or Rejetto HFS) that require urgent intervention.
- Traffic and network log monitoring: Monitor connection logs to identify unusual HTTP requests, suspicious privilege escalation attempts, or abnormal connections specific to botnet activity (e.g., unexpected use of the STUN protocol).
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
