In the security bulletin of October 7, 2026, we analyze the active vulnerabilities recently reported by CISA and other cybersecurity organizations, providing details on critical security flaws in network equipment, enterprise applications, and artificial intelligence platforms.
Actively exploited vulnerabilities
Citrix NetScaler (CVE-2026-88779)
An “improper restriction of operations within the bounds of a memory buffer” vulnerability in Citrix NetScaler ADC and NetScaler Gateway products allows attackers to cause a Denial of Service (DoS) state. Full details are available on NVD.
Zammad GmbH Zammad (CVE-2026-102490 & CVE-2026-102489)
Zammad is affected by two vulnerabilities that can be chained together. The first, CVE-2026-102489, is a session fixation weakness that allows remote code execution (RCE) under “zammad” user privileges. The second, CVE-2026-102490, represents improper privilege management that allows local privilege escalation to root. Details: CVE-2026-102489 and CVE-2026-102490.
Fortinet FortiMail (CVE-2026-104286)
A “path traversal” and incorrect neutralization of NULL characters vulnerability allows an unauthenticated attacker to write arbitrary files into the underlying system via modified HTTP/HTTPS requests. Source: NVD.
Cisco Catalyst SD-WAN Manager (CVE-2026-76504)
Due to improper handling of URI encoding in HTTP requests, a “hex encoding” vulnerability allows a remote, unauthenticated attacker to access the system with administrator privileges. Source: NVD.
New critical vulnerabilities
SPIP Crayons Plugin (CVE-2026-104070)
A missing authorization vulnerability in the Crayons plugin for SPIP (versions prior to 3.5.0) allows unauthenticated attackers to modify arbitrary fields. This flaw can be exploited to upload malicious .html files and execute arbitrary PHP code on the web server. Details: NVD.
IBM Langflow OSS (CVE-2026-104334 & CVE-2026-93674)
Versions 1.0.0 through 1.12.2 of IBM Langflow OSS are affected by two critical remote code execution vulnerabilities. CVE-2026-104334 involves improper control of generation of code, while CVE-2026-93674 is caused by insufficient neutralization of special elements in operating system commands (OS command injection). Sources: CVE-2026-104334 and CVE-2026-93674.
From the security press
Model Context Protocol (MCP) ecosystem under scrutiny
An analysis conducted by OX Security reveals critical vulnerabilities in public servers based on the Model Context Protocol (MCP) used in AI. Although the standardized protocol developed by Anthropic facilitates the connection of AI assistants to data, the security of implementations has proven to be weak in many cases. Details: The Hacker News.
Atlassian Data Center (CVE-2026-21589)
A critical vulnerability affects 8 Atlassian Data Center products hosted on-premise, allowing unauthenticated attackers to read known files from the web application’s root directory, provided they know the exact file name and path. Details: The Hacker News.
Security recaps: Active NetScaler and FortiMail exploits
A weekly recap highlights an increase in attacks exploiting small configuration slip-ups and active bugs in peripheral equipment such as NetScaler or FortiMail, emphasizing the need for increased attention to patching. Details: The Hacker News.
Cling botnet targets Realtek Jungle SDK
Cyber actors exploit an older vulnerability in Realtek Jungle SDK to propagate the Cling botnet, which uses the STUN protocol for command and control (C2) activities. Details: The Hacker News.
Rejetto HTTP File Server (CVE-2026-61500)
A critical session hijacking vulnerability affects Rejetto HFS. Due to a weak pseudo-random number generator, attackers can generate predictable keys to gain unauthorized access and execute remote code (RCE). Details: The Hacker News.
Recommendations
- Urgent Patching (Patch Management): Immediately update exposed systems such as Citrix NetScaler, Fortinet FortiMail, Cisco Catalyst SD-WAN, as well as Atlassian Data Center products and SPIP/Langflow installations to secure versions.
- Asset Inventory: Perform a complete inventory of all internet-exposed systems, with a particular focus on file servers, SD-WAN management consoles, and helpdesk software instances (Zammad).
- Continuous Monitoring: Implement detection rules to identify directory traversal (Path Traversal) attempts in FortiMail and anomalous URI queries in Cisco Catalyst SD-WAN.
- AI Asset Protection: For organizations using emerging technologies (such as IBM Langflow or servers based on Model Context Protocol), limit network access and ensure that automatically generated code runs in isolated environments (sandbox).
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
