The situation

FortiMail Zero-day Under Active Exploitation

CVE-2026-104286 in FortiMail management interface exploited; patch deadline Oct 4 with KEV remediation.

Composed by SitRep’s AI editors from 4 sources — BleepingComputer, Breaches.net, Help Net Security, Exploitdb

FortiMail Zero-day Actively Exploited, KEV Deadline

Fortinet warns that CVE-2026-104286 (CVSS 9.8) targeting FortiMail management interfaces is being actively exploited across affected releases (7.2.x–8.0.x). Vendor patches are scheduled, and the issue is listed in CISA KEV with an Oct 4 remediation deadline. Workarounds are limited (disable IBE or restrict Internet access) and published IOCs and blocks are available for detection and triage.

Context

Management interfaces of mail gateways remain high-value targets; exploitation yields persistent admin access across organizations. With multiple high-severity in-the-wild exploits, exposed Internet-facing devices and poorly segmented networks expand the blast radius and complicate containment.

“The shared pattern is exploitation of unauthenticated or management-interface flaws prior to full vendor fixes.”

The move

5 things to do today

Patch FortiMail to vendor’s fixed releases (apply 7.4.9, 7.6.7, or 8.0.2 when available) and implement immediate network ACLs to restrict management interface access (CVE-2026-104286).
Upgrade Citrix NetScaler appliances to 14.1-73.37 or 13.1-64.23 and run forensic triage for indicators of compromise on devices remaining on older releases (CVE-2026-88771/CVE-2026-88772).
Isolate and/or upgrade Zammad instances to version 7, rotate service and admin credentials, and hunt using published IoCs for session hijacking or privilege escalation artifacts (CVE-2026-102489/CVE-2026-102490).
Block or segment access to dxweb/dxmanager and monitor for uploads to C:\Windows\Temp plus unexpected dxmanager restarts; treat any such findings as active compromise for Ecava IntegraXor IGX 16.0.701.10.
Hunt for webshells/backdoors and rotate credentials on any appliance or management host that was Internet-accessible prior to patching; record containment steps and preserve forensic evidence before remediation.

On the wire

P0Exploit

FortiMail CVE-2026-104286 Actively Exploited; KEV Deadline Oct 4

CVE-2026-104286 (CVSS 9.8) targets FortiMail management interfaces and is being actively exploited; CISA added it to the KEV with an Oct 4 requirement. Patch when vendor updates (7.4.9, 7.6.7, 8.0.2) are available, immediately restrict Internet access to management interfaces, and deploy published IOCs and network blocks to detect exploitation.

BLEEPINGCOMPUTER · Fortinet Warns of Critical FortiMail Flaw Exploited in Zero-Day Attacks

P0Exploit

Citrix NetScaler CVE-2026-88771/88772 Exploited at Scale; Upgrade Now

Two unauthenticated RCEs (CVE-2026-88771 and CVE-2026-88772) were exploited against NetScaler ADC/Gateway, affecting an estimated 50,000 devices. Upgrade exposed appliances to 14.1-73.37 or 13.1-64.23 immediately, apply network-level access controls, and run forensic triage for post‑exploit indicators.

BREACHES.NET · Suspected State Hackers Exploited Citrix NetScaler Zero-Days

P3Ransomware

KillSec Infrastructure Seized in International Takedown

Law-enforcement Operation KillSwitch seized KillSec servers and data (~110 TB) and arrested operators, disrupting an actor that launched ~500 attacks. Use seized indicators to hunt for related activity in your environment and reassess exposure to KillSec ransomware variants.

BLEEPINGCOMPUTER · Police Dismantle KillSec Ransomware Gang in Operation KillSwitch

P1Application

Zammad CVE-2026-102489/102490 Used in Agentic AI Breach

Two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) were chained by an AI agent to gain RCE and root in the DIVD breach. Isolate internet-facing Zammad instances, upgrade to Zammad version 7 or take offline, run IoC-based hunts and credential rotation for compromised accounts.

HELP NET SECURITY · AI Agent Exploits Zammad Zero-Days to Breach DIVD

P1Exploit

Ecava IntegraXor IGX 16.0.701.10 Unauthenticated RCE via /FileUpload

IntegraXor IGX 16.0.701.10 exposes an unauthenticated /FileUpload endpoint that enables RCE by staging a BAT in C:\Windows\Temp and instructing dxmanager to execute it. Block or isolate dxweb/dxmanager, monitor uploads to C:\Windows\Temp, and watch for unexpected dxmanager restarts or new startup entries.

EXPLOITDB · Ecava IntegraXor IGX 16.0.701.10 RCE via Unauthenticated FileUpload

Indicators named in this edition

Kind	Value	Note
CVE	CVE-2026-104286	FortiMail critical management-interface vulnerability (CVSS 9.8)
CVE	CVE-2026-88771	Citrix NetScaler unauthenticated RCE
CVE	CVE-2026-88772	Citrix NetScaler unauthenticated RCE
CVE	CVE-2026-102489	Zammad zero-day used in DIVD breach
CVE	CVE-2026-102490	Zammad zero-day used in DIVD breach

Elsewhere in the edition

Hackers Steal Pentagon DMDC Records Of Over 3 Million

Hackers breached the Pentagon’s Defense Manpower Data Center (DMDC) in Oct 2025, exposing data for more than 3 million people (2.8 million living, 294,000 deceased). Exposed details include Social Security numbers, names, dates of birth, contact information, sex, race, and other PII. DMDC issued letters, offered 12 months of free credit monitoring via IDX, with enrollment by Aug 19, 2027.

5 reports

BLEEPINGCOMPUTERHackers Steal Pentagon DMDC Records Of Over 3 Million
NEWSAPI CYBER INSIGHTSMassive Pentagon Hack Leaks 2.7 Million Records, Including SSNs
HELP NET SECURITYPentagon DMDC data breach affects over 3 million people
MALWAREBYTES LABSPentagon Breach Exposes Social Security Numbers and Military Records
NEWSAPI CYBER INSIGHTSPentagon DMDC Breach Exposes SSNs and Military Records

Google Rolls Out Gemini 4 Argon Guardrail-Free Access for Defenders

Google announced Gemini 4 Argon, its frontier AI model, starting with a limited rollout to trusted cyber defenders via the Fairwind program. Argon can autonomously find, validate, and patch vulnerabilities, and will initially run without guardrails for vetted users. It previously demonstrated vulnerability discovery in hospital software through Wiz, and Google aims to expand access while maintain…

5 reports

SECURITYWEEKGoogle Rolls Out Gemini 4 Argon Guardrail-Free Access for Defenders
THE HACKER NEWSGoogle Rolls Out Gemini 4 Argon to Trusted Defenders
NEWSAPI CYBER INSIGHTSGoogle Rolls Out Gemini 4 Argon With Access Restrictions
NEWSAPI CYBER INSIGHTSGoogle's Gemini 4 Argon Tested on Its Own Infrastructure
NEWSAPI CYBER INSIGHTSInside Gemini 4 Argon: Google’s In‑House Testing and Security Focus

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

CISA added CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager, to the KEV after active exploitation. The flaw lets unauthenticated remote attackers gain admin-level access via crafted HTTP requests due to URI encoding handling. Cisco provides IoCs and remediation steps; FCEB agencies must patch by Oct 3, 2026. Upgrade to fixed release and monitor /j_security_check U…

5 reports

THE HACKER NEWSCISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
SECURITYWEEKCisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability
NEWSAPI CYBER INSIGHTSCritical Cisco Catalyst SD-WAN Zero-Day Exploited in the Wild
HELP NET SECURITYCisco SD-WAN CVE-2026-76504 Zero-Day Exploited in the Wild
NEWSAPI CYBER INSIGHTSCISA Adds Cisco Catalyst SD-WAN Manager Flaw to KEV List

Armadin Raises $255 Million Series B at $2.5 Billion Valuation

Armadin raises $255.5 million in Series B at a $2.5B valuation, totaling about $445M in funding seven months after its public launch. Backers include Andreessen Horowitz, Accel, Bain Capital Ventures, Redpoint, with earlier rounds of $189.9M (Mar 2026) and a $24M seed (2025). In Aug, Armadin and TENEX[.]ai executed 1,300 AI-driven attacks using 26,000 agents across 25,000 services, producing 238…

4 reports

SECURITYWEEKArmadin Raises $255 Million Series B at $2.5 Billion Valuation
NEWSAPI CYBER INSIGHTSArmadin Raises $255.5M at $2.5B Valuation, Mandia Launches Agent Swarm
NEWSAPI CYBER INSIGHTSArmadin Raises $255 Million to Scale Agentic Cybersecurity Platform
HELP NET SECURITYArmadin Secures $255.5 Million in Series B to Expand AI Offense Platform

Alphabet Stocks Dip as Gemini 4 Argon Debuts Behind Safety Gate

Alphabet shares fell about 1% to $337.20 at 12pm ET on Oct 1 as Gemini 4 Argon was unveiled for selected cybersecurity defenders under the Fairwind program, per GuruFocus and Yahoo Finance coverage.

3 reports

NEWSAPI CYBER INSIGHTSAlphabet Stocks Dip as Gemini 4 Argon Debuts Behind Safety Gate
NEWSAPI CYBER INSIGHTSAlphabet Shares Rise After Google Launches Gemini 4 Argon AI Model
NEWSAPI CYBER INSIGHTSAlphabet Shares Rise Pre-market on Gemini 4 Argon Launch

Osavul Secures 10 Million for Hybrid Risk Intelligence Platform

Osavul raises $10 million (approx. €8.5M) in a Series A led by 33N Ventures with Balnord, G+D Ventures, and 42CAP. Luxembourg-based firm’s AI analyzes open and privileged data to identify hostile intent across cyber, physical, and information domains, with on‑premises deployment. It serves government, defense, and security bodies in more than 10 countries, citing 150+ state-linked Europe incident…

2 reports

SECURITYWEEKOsavul Secures 10 Million for Hybrid Risk Intelligence Platform
NEWSAPI CYBER INSIGHTSOsavul Secures €8.5M Series A for Hostile Threat Warning

PwC Survey Finds Firms Underprepared for AI and Quantum Threats

PwC's 2027 Global Digital Trust Insights survey of ~4,000 leaders in 70+ countries shows limited uptake of quantum-resistant security (21%) and autonomous AI defense (22%). Concerns include autonomous botnets (53%), adversarial attacks (52%), and data poisoning (52%). Budgets rise (), with AI as top cyber-priority (58%). Accountability often lies with CIO/CTO () rather than the CISO (17%), amid p…

2 reports

SECURITYWEEKPwC Survey Finds Firms Underprepared for AI and Quantum Threats
NEWSAPI CYBER INSIGHTSPwC Finds Adversarial AI Top Cybersecurity Gap

Insights From The 2026 Microsoft Digital Defense Report

Microsoft's 2026 Digital Defense Report describes an increasingly interconnected security landscape where threat activity spans infrastructure, identities, apps, cloud, and supply chains. It highlights AI-enabled threat capabilities, the role of agents in enterprise workflows, and core security disciplines—identity, data protection, least privilege, monitoring, and secure software development—nee…

2 reports

MICROSOFT SECUREInsights From The 2026 Microsoft Digital Defense Report
MICROSOFT SECUREPreparing Governments for An Era of Interconnected Cyber Risk

Also reported

BLEEPINGCOMPUTERAutonomous AI Agents Attempted to Hack US and Canadian Government Sites
BLEEPINGCOMPUTERMicrosoft Says Threat Actors Are Ahead in the Early AI Race
SECURITYWEEKZero Trust Holds Firm Against AI Attacks, Says Creator
THE HACKER NEWSThreatsDay Highlights AI-Powered Zero-Day Chain and Secrets
THE HACKER NEWSWordPress Backdoor Self-Heals Across Files, Database and Memory
SECURITYWEEKHacker Conversations: Rob Juncker’s Path From Cracking to Defending
BLEEPINGCOMPUTERDay-One Hole in Zero Trust Architecture Highlights Onboarding Risks
BLEEPINGCOMPUTERKiteworks Patches Max Severity Code Injection in Email Protection Gateway
SECURITYWEEKAI Accelerates Attacks, But Security Fundamentals Endure in Enterprise Environments
SECURITYWEEKZimbra Vulnerability Exploited Before Public Disclosure

End of the Thursday, October 1, 2026 edition.