The CyberSec Intelligence specialist team presents the daily synthesis of cybersecurity vulnerabilities reported on October 8, 2026. This bulletin includes details about vulnerabilities actively exploited in the wild, newly identified critical breaches, relevant news from the specialty press, and practical remediation measures to protect IT infrastructure.
Actively exploited vulnerabilities
- CVE-2026-88779 (Citrix NetScaler): Affects Citrix NetScaler ADC and Citrix NetScaler Gateway. An improper restriction of operations within the memory buffer vulnerability allows attackers to cause a Denial of Service state. Details on NVD.
- CVE-2026-102490 and CVE-2026-102489 (Zammad GmbH Zammad): Security deficiencies involving incorrect privilege management (allowing escalation to root privileges for the local user) and session fixation (which can lead to remote code execution). These vulnerabilities can be chained. Details on NVD CVE-2026-102490 and NVD CVE-2026-102489.
- CVE-2026-104286 (Fortinet FortiMail): A Path Traversal and improper null character neutralization vulnerability allows an unauthenticated attacker to write arbitrary files to the system via specially crafted HTTP or HTTPS requests. Details on NVD.
New critical vulnerabilities
- CVE-2026-104070: Identified in the Crayons plugin for SPIP (prior to version 3.5.0). The lack of authorization allows unauthenticated attackers to modify object fields, upload malicious HTML template files, and execute arbitrary PHP code on the web server. Details on NVD.
- CVE-2026-106237: An information leak in permissions in Google Chrome (prior to version 155.0.8059.39) allows a remote attacker to bypass site isolation via a specially crafted HTML page. Details on NVD.
- CVE-2026-76454: Affects the Cisco Smart Licensing utility within Cisco License On-Prem (formerly SSM On-Prem). Incorrect data validation and the lack of authentication in the administration API allow unauthenticated attackers to write arbitrary files or cause DoS. Details on NVD.
- CVE-2026-76500: Identified in Cisco Application Policy Infrastructure Controller (APIC), the breach targets improper control of a resource during its lifetime (CWE-664). Details on NVD.
- CVE-2026-76268: Affects Splunk Enterprise versions prior to 10.4.3 and 10.2.7. An unauthenticated user with network access to the Patroni REST API interface of a cluster node can execute commands in the host operating system due to the lack of authentication. Details on NVD.
From the security press
- No associated CVE (SonicWall SMA1000): SonicWall has released hotfixes to address four vulnerabilities in SMA1000 appliances. The most severe of these (CVSS score 10.0) is a pre-authentication SSRF vulnerability that allows accessing internal functions. Source: The Hacker News.
- No associated CVE (LMCache): An unpatched critical vulnerability in the open-source LMCache system allows remote code execution without authentication in multi-process mode via the ZeroMQ library. Source: The Hacker News.
- CVE-2026-21589: A critical flaw in Atlassian Data Center products (Bitbucket, Confluence, Jira) that allows unauthorized access to sensitive files began being exploited just two hours after the technical details were published. Source: The Hacker News.
- No associated CVE (MCP Servers): An analysis conducted by the OX Security team reveals critical vulnerabilities in the ecosystem of the AI connection protocol Model Context Protocol (MCP) developed by Anthropic, exposing numerous public servers. Source: The Hacker News.
What we recommend
- Rapid system updating (Patch Management): Prioritize installing official security updates for technologies affected by actively exploited or critical vulnerabilities (Citrix NetScaler, Fortinet FortiMail, Atlassian products, and SonicWall SMA1000 appliances).
- Asset inventory and isolation (Asset Inventory): Identify all active instances of Cisco APIC/SSM, Splunk Enterprise, LMCache solutions, and servers based on the MCP protocol within your network and ensure they are not exposed unprotected to the public internet.
- Continuous logging and monitoring (Logging & Monitoring): Configure alerts in SIEM platforms to detect Path Traversal attempts, unauthorized API calls without authentication, or unusual file modifications on network-exposed systems.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
