You are reading a back issue. Go to the latest edition →

The situation

FortiMail Zero-day Actively Exploited, KEV Deadline

CVE-2026-104286 in FortiMail management interface exploited; patch deadline Oct 4 with KEV remediation.

Composed by SitRep’s AI editors from 4 sources — BleepingComputer, Breaches.net, Help Net Security, Exploitdb

Fortinet warns that CVE-2026-104286 (CVSS 9.8) targeting FortiMail management interfaces is being actively exploited across affected releases (7.2.x–8.0.x). Vendor patches are scheduled, and the issue is listed in CISA KEV with an Oct 4 remediation deadline. Workarounds are limited (disable IBE or restrict Internet access) and published IOCs and blocks are available for detection and triage.

Context

Management interfaces of mail gateways remain high-value targets; exploitation yields persistent admin access across organizations. With multiple high-severity in-the-wild exploits, exposed Internet-facing devices and poorly segmented networks expand the blast radius and complicate containment.

“The shared pattern is exploitation of unauthenticated or management-interface flaws prior to full vendor fixes.”

From the analysis

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

AI-accelerated discovery and weaponization are compressing the window from disclosure to exploitation, forcing concurrent patching, triage, and containment across appliances and web apps.

BleepingComputer · Breaches.net · Help Net Security

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Patching Alone Won't Remove Active Footholds

Most security teams will treat vendor patching as the whole response. That is the wrong read because adversaries who already exploited management interfaces may retain webshells, backdoors, or credentials—requiring segmentation, detection, credential rotation, and forensic containment in addition to patching.

BleepingComputer · Breaches.net · Help Net Security

Anyone with the link reads the whole edition, free. The link says nothing about you.

Email it

The move

5 things to do today

Patch FortiMail to vendor’s fixed releases (apply 7.4.9, 7.6.7, or 8.0.2 when available) and implement immediate network ACLs to restrict management interface access (CVE-2026-104286).
Upgrade Citrix NetScaler appliances to 14.1-73.37 or 13.1-64.23 and run forensic triage for indicators of compromise on devices remaining on older releases (CVE-2026-88771/CVE-2026-88772).
Isolate and/or upgrade Zammad instances to version 7, rotate service and admin credentials, and hunt using published IoCs for session hijacking or privilege escalation artifacts (CVE-2026-102489/CVE-2026-102490).
Block or segment access to dxweb/dxmanager and monitor for uploads to C:\Windows\Temp plus unexpected dxmanager restarts; treat any such findings as active compromise for Ecava IntegraXor IGX 16.0.701.10.
Hunt for webshells/backdoors and rotate credentials on any appliance or management host that was Internet-accessible prior to patching; record containment steps and preserve forensic evidence before remediation.

On the wire

2critical
2elevated
0moderate
1low

P0Exploit

FortiMail CVE-2026-104286 Actively Exploited; KEV Deadline Oct 4

CVE-2026-104286 (CVSS 9.8) targets FortiMail management interfaces and is being actively exploited; CISA added it to the KEV with an Oct 4 requirement. Patch when vendor updates (7.4.9, 7.6.7, 8.0.2) are available, immediately restrict Internet access to management interfaces, and deploy published IOCs and network blocks to detect exploitation.

BLEEPINGCOMPUTER · Fortinet Warns of Critical FortiMail Flaw Exploited in Zero-Day Attacks

Copy link to “FortiMail CVE-2026-104286 Actively Exploited; KEV Deadline Oct 4”

P0Exploit

Citrix NetScaler CVE-2026-88771/88772 Exploited at Scale; Upgrade Now

Two unauthenticated RCEs (CVE-2026-88771 and CVE-2026-88772) were exploited against NetScaler ADC/Gateway, affecting an estimated 50,000 devices. Upgrade exposed appliances to 14.1-73.37 or 13.1-64.23 immediately, apply network-level access controls, and run forensic triage for post‑exploit indicators.

Previously in SitRep Sep 30: CVE-2026-88771/CVE-2026-88772 NetScaler Zero-days in Active Exploitation

BREACHES.NET · Suspected State Hackers Exploited Citrix NetScaler Zero-Days

Copy link to “Citrix NetScaler CVE-2026-88771/88772 Exploited at Scale; Upgrade Now”

P3Ransomware

KillSec Infrastructure Seized in International Takedown

Law-enforcement Operation KillSwitch seized KillSec servers and data (~110 TB) and arrested operators, disrupting an actor that launched ~500 attacks. Use seized indicators to hunt for related activity in your environment and reassess exposure to KillSec ransomware variants.

BLEEPINGCOMPUTER · Police Dismantle KillSec Ransomware Gang in Operation KillSwitch

Copy link to “KillSec Infrastructure Seized in International Takedown”

P1Application

Zammad CVE-2026-102489/102490 Used in Agentic AI Breach

Two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) were chained by an AI agent to gain RCE and root in the DIVD breach. Isolate internet-facing Zammad instances, upgrade to Zammad version 7 or take offline, run IoC-based hunts and credential rotation for compromised accounts.

Previously in SitRep Sep 30: Zammad Zero-days Enabled AI‑driven Rapid Takeover and Credential Leakage · CVE-2026-102489, CVE-2026-102490

HELP NET SECURITY · AI Agent Exploits Zammad Zero-Days to Breach DIVD

Copy link to “Zammad CVE-2026-102489/102490 Used in Agentic AI Breach”

P1Exploit

Ecava IntegraXor IGX 16.0.701.10 Unauthenticated RCE via /FileUpload

IntegraXor IGX 16.0.701.10 exposes an unauthenticated /FileUpload endpoint that enables RCE by staging a BAT in C:\Windows\Temp and instructing dxmanager to execute it. Block or isolate dxweb/dxmanager, monitor uploads to C:\Windows\Temp, and watch for unexpected dxmanager restarts or new startup entries.

EXPLOITDB · Ecava IntegraXor IGX 16.0.701.10 RCE via Unauthenticated FileUpload

Copy link to “Ecava IntegraXor IGX 16.0.701.10 Unauthenticated RCE via /FileUpload”

Vulnerabilities named in this edition

CVE-2026-104286 · CVE-2026-88771 · CVE-2026-88772 · CVE-2026-102489 · CVE-2026-102490

Known exploited

Added 1 Oct1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2026-104286	Fortinet FortiMail	1 Oct	4 Oct

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

Hackers Steal Pentagon DMDC Records Of Over 3 Million

Hackers breached the Pentagon’s Defense Manpower Data Center (DMDC) in Oct 2025, exposing data for more than 3 million people (2.8 million living, 294,000 deceased). Exposed details include Social Security numbers, names, dates of birth, contact information, sex, race, and other PII. DMDC issued letters, offered 12 months of free credit monitoring via IDX, with enrollment by Aug 19, 2027.

5 reports

BLEEPINGCOMPUTERHackers Steal Pentagon DMDC Records Of Over 3 Million
NEWSAPI CYBER INSIGHTSMassive Pentagon Hack Leaks 2.7 Million Records, Including SSNs
HELP NET SECURITYPentagon DMDC data breach affects over 3 million people
MALWAREBYTES LABSPentagon Breach Exposes Social Security Numbers and Military Records
NEWSAPI CYBER INSIGHTSPentagon DMDC Breach Exposes SSNs and Military Records

Google Rolls Out Gemini 4 Argon Guardrail-Free Access for Defenders

Google announced Gemini 4 Argon, its frontier AI model, starting with a limited rollout to trusted cyber defenders via the Fairwind program. Argon can autonomously find, validate, and patch vulnerabilities, and will initially run without guardrails for vetted users.

5 reports

SECURITYWEEKGoogle Rolls Out Gemini 4 Argon Guardrail-Free Access for Defenders
THE HACKER NEWSGoogle Rolls Out Gemini 4 Argon to Trusted Defenders
NEWSAPI CYBER INSIGHTSGoogle Rolls Out Gemini 4 Argon With Access Restrictions
NEWSAPI CYBER INSIGHTSInside Gemini 4 Argon: Google’s In‑House Testing and Security Focus
NEWSAPI CYBER INSIGHTSGoogle's Gemini 4 Argon Tested on Its Own Infrastructure

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

CISA added CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager, to the KEV after active exploitation. The flaw lets unauthenticated remote attackers gain admin-level access via crafted HTTP requests due to URI encoding handling. Cisco provides IoCs and remediation steps; FCEB agencies must patch by Oct 3, 2026.

5 reports

THE HACKER NEWSCISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
SECURITYWEEKCisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability
NEWSAPI CYBER INSIGHTSCritical Cisco Catalyst SD-WAN Zero-Day Exploited in the Wild
HELP NET SECURITYCisco SD-WAN CVE-2026-76504 Zero-Day Exploited in the Wild
NEWSAPI CYBER INSIGHTSCISA Adds Cisco Catalyst SD-WAN Manager Flaw to KEV List

Armadin Raises $255 Million Series B at $2.5 Billion Valuation

Armadin raises $255.5 million in Series B at a $2.5B valuation, totaling about $445M in funding seven months after its public launch. Backers include Andreessen Horowitz, Accel, Bain Capital Ventures, Redpoint, with earlier rounds of $189.9M (Mar 2026) and a $24M seed (2025).

4 reports

SECURITYWEEKArmadin Raises $255 Million Series B at $2.5 Billion Valuation
NEWSAPI CYBER INSIGHTSArmadin Raises $255.5M at $2.5B Valuation, Mandia Launches Agent Swarm
NEWSAPI CYBER INSIGHTSArmadin Raises $255 Million to Scale Agentic Cybersecurity Platform
HELP NET SECURITYArmadin Secures $255.5 Million in Series B to Expand AI Offense Platform

Alphabet Stocks Dip as Gemini 4 Argon Debuts Behind Safety Gate

Alphabet shares fell about 1% to $337.20 at 12pm ET on Oct 1 as Gemini 4 Argon was unveiled for selected cybersecurity defenders under the Fairwind program, per GuruFocus and Yahoo Finance coverage.

3 reports

NEWSAPI CYBER INSIGHTSAlphabet Stocks Dip as Gemini 4 Argon Debuts Behind Safety Gate
NEWSAPI CYBER INSIGHTSAlphabet Shares Rise After Google Launches Gemini 4 Argon AI Model
NEWSAPI CYBER INSIGHTSAlphabet Shares Rise Pre-market on Gemini 4 Argon Launch

Osavul Secures 10 Million for Hybrid Risk Intelligence Platform

Osavul raises $10 million (approx. €8.5M) in a Series A led by 33N Ventures with Balnord, G+D Ventures, and 42CAP. Luxembourg-based firm’s AI analyzes open and privileged data to identify hostile intent across cyber, physical, and information domains, with on‑premises deployment.

2 reports

SECURITYWEEKOsavul Secures 10 Million for Hybrid Risk Intelligence Platform
NEWSAPI CYBER INSIGHTSOsavul Secures €8.5M Series A for Hostile Threat Warning

PwC Survey Finds Firms Underprepared for AI and Quantum Threats

PwC's 2027 Global Digital Trust Insights survey of ~4,000 leaders in 70+ countries shows limited uptake of quantum-resistant security (21%) and autonomous AI defense (22%). Concerns include autonomous botnets (53%), adversarial attacks (52%), and data poisoning (52%). Budgets rise (), with AI as top cyber-priority (58%).

2 reports

SECURITYWEEKPwC Survey Finds Firms Underprepared for AI and Quantum Threats
NEWSAPI CYBER INSIGHTSPwC Finds Adversarial AI Top Cybersecurity Gap

Insights From The 2026 Microsoft Digital Defense Report

Microsoft's 2026 Digital Defense Report describes an increasingly interconnected security landscape where threat activity spans infrastructure, identities, apps, cloud, and supply chains. It highlights AI-enabled threat capabilities, the role of agents in enterprise workflows, and core security disciplines—identity, data protection, least privilege, monitoring, and secure software…

2 reports

MICROSOFT SECUREInsights From The 2026 Microsoft Digital Defense Report
MICROSOFT SECUREPreparing Governments for An Era of Interconnected Cyber Risk

Also reported

BLEEPINGCOMPUTERAutonomous AI Agents Attempted to Hack US and Canadian Government Sites
BLEEPINGCOMPUTERMicrosoft Says Threat Actors Are Ahead in the Early AI Race
SECURITYWEEKZero Trust Holds Firm Against AI Attacks, Says Creator
THE HACKER NEWSThreatsDay Highlights AI-Powered Zero-Day Chain and Secrets
THE HACKER NEWSWordPress Backdoor Self-Heals Across Files, Database and Memory
SECURITYWEEKHacker Conversations: Rob Juncker’s Path From Cracking to Defending
BLEEPINGCOMPUTERDay-One Hole in Zero Trust Architecture Highlights Onboarding Risks
BLEEPINGCOMPUTERKiteworks Patches Max Severity Code Injection in Email Protection Gateway
SECURITYWEEKAI Accelerates Attacks, But Security Fundamentals Endure in Enterprise Environments
SECURITYWEEKZimbra Vulnerability Exploited Before Public Disclosure

End of the Thursday, October 1, 2026 edition.

Read the whole paper free, by email each morning. Get the brief →

Colophon

SitRep · Vol. 1, No. 13

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
Editors: Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure: Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections: brief@sitrepit.com or the contact page.