Friday, October 2, 2026|Issue 15|6 min read|Join the discussion
Security infrastructure itself is becoming the attack surface
The systems designed to protect and control enterprise infrastructure are themselves becoming prime targets. An actively exploited FortiMail zero-day, Cisco SD-WAN control-plane exploitation, an AI agent chaining zero-days and Microsoft's 2026 threat report all point toward authority plus speed.
The short version
- FortiMail CVE-2026-104286: exploited unauthenticated file write, KEV October 1, federal deadline October 4.
- Cisco Catalyst SD-WAN Manager CVE-2026-76504: exploited auth bypass to admin API access; fixed releases, no workaround.
- DIVD says an AI agent chained two Zammad zero-days to break into its network.
- Europol and Eurojust's Operation KillSwitch took down KillSec, linked to around 1,000 attacks.
- Microsoft's 2026 Digital Defense Report: AI is compressing familiar attack chains.
Issue at a glance
2 critical1 high1 notable
- criticalNetworkFortiMail zero-day is under active attack
- criticalNetworkCisco SD-WAN Manager auth bypass hands out admin
- highAIDIVD says an AI agent chained two Zammad zero-days
- notableRansomwareOperation KillSwitch takes down KillSec
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | Authentication bypass to admin API access. Due October 3 | Critical, KEV, exploited |
| CVE-2026-104286 | Fortinet FortiMail | Unauthenticated arbitrary file write. Due October 4 | Critical, KEV, exploited |
Fortinet PSIRT FG-IR-26-175|CISA|Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU|Cisco remediation guide|CISA KEV catalog
Breaking
Fortinet / email security / KEV
FortiMail zero-day is under active attack
CVE-2026-104286 is a path-traversal and null-byte flaw in FortiMail that lets an unauthenticated attacker write arbitrary files via crafted HTTP or HTTPS requests. Fortinet says it has been exploited in the wild; CISA added it to KEV on October 1 with an October 4 federal deadline. Fortinet lists the fixes as 8.0.2, 7.6.7 and 7.4.9; 7.2 users must move to 7.4 or later.
Why it matters. FortiMail sits on the inbound mail path. File write there can become code execution on a trusted gateway.
What to do. Upgrade to the fixed release for your branch. Until then, apply Fortinet's workaround, restrict management and webmail exposure, preserve evidence and hunt Fortinet's IOCs.
CVE-2026-104286
Cisco / SD-WAN / KEV
Cisco SD-WAN Manager auth bypass hands out admin
CVE-2026-76504 stems from improper handling of URI encoding: a crafted HTTP request can bypass authentication and reach the API as admin. Cisco confirms exploitation, says there is no workaround and has released fixes. CISA's catalog lists an October 3 federal deadline.
Why it matters. SD-WAN Manager is the control plane for branch, cloud and data-center connectivity.
What to do. Upgrade, then investigate: collect admin-tech files and follow Cisco's remediation guide, including its log review for suspicious URL-encoded requests to management endpoints.
CVE-2026-76504
Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU|Cisco remediation guide|CISA KEV catalog
AI / zero-day / Zammad
DIVD says an AI agent chained two Zammad zero-days
The Dutch Institute for Vulnerability Disclosure says attackers broke in on September 21 using two previously unknown Zammad flaws, CVE-2026-102489 and CVE-2026-102490, which together allowed session hijacking, remote code execution and escalation to root. DIVD assesses the attack as agentic-AI powered, citing notes in which the agent justified its own actions, and says it was loud and messy. Segmentation stopped deeper movement; the investigation is ongoing and no known threat actor has been linked.
Why it matters. Whatever the exact degree of autonomy, automation compresses the time from foothold to root.
What to do. Patch Zammad, segment helpdesk systems from sensitive services and alert on rapid privilege escalation from application accounts.
CVE-2026-102489, CVE-2026-102490
law enforcement / ransomware
Operation KillSwitch takes down KillSec
Europol and Eurojust coordinated action against the KillSec extortion group, linked to around 1,000 attacks worldwide. Three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain and the UK, servers and the leak site were seized, and a 16-year-old was identified as the suspected main operator.
Why it matters. KillSec got in through poorly secured access points, especially cloud storage. Takedowns help; the entry points remain.
What to do. Review exposed cloud storage and remote-access points; the same weaknesses will be used by the next group.
Trends
Exposure × Authority × Adversary Speed
If compromised, what authority does this system provide, and how quickly can that authority be used before we stop it? Mail gateways, SD-WAN managers and helpdesk platforms concentrate authority, and AI is shrinking the time attackers need to use it.
AI accelerates familiar attack chains
Microsoft's 2026 Digital Defense Report says AI is compressing attack timelines and automating more of the attack chain, while attackers' objectives and targets are largely unchanged. Reconnaissance, social engineering, exploit work and post-compromise activity are getting faster rather than becoming entirely new categories.
Security appliances are a concentrated attack surface
FortiMail, SD-WAN Manager and last week's NetScaler flaws share a pattern: the box trusted to filter or route traffic becomes the most valuable place to land. Treat these as tier-zero assets.
Fortinet PSIRT FG-IR-26-175|CISA|Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU|Cisco remediation guide|CISA KEV catalog
Machine-speed offense needs machine-assisted defense
DIVD's account shows exploitation and escalation happening in seconds. Defense needs automation too, with clear authorization guardrails on what defensive agents can change.
Clearance corner
KEV deadlines under BOD 26-04
Back-to-back Cisco and FortiMail deadlines show BOD 26-04's model: confirmed exploitation and exposure drive priority. Be ready to show the fix and the investigation, not just the scan result.
What we are watching next
FortiMail
October 4 deadline and further IOCs.
Cisco SD-WAN
Compromise findings around the October 3 deadline.
DIVD / Zammad
Investigation results and how much of the attack was truly autonomous.
KillSec
Charges, further arrests and victim notifications.
AI and vulnerability research
How quickly AI-found flaws turn into exploitation.
Sources
Join the discussion
Loading comments…