Daily brief · 2026-10-02
Fortinet FortiMail Under Active Attack + 2 More Fixes
Fortinet FortiMail
CISA has added a critical path traversal and improper neutralization flaw affecting Fortinet FortiMail to its Known Exploited Vulnerabilities catalog. Fortinet previously issued an advisory for this critical path traversal vulnerability in FortiMail, and CISA made the addition based on evidence that it is currently being exploited in the wild.
Why it matters: The vulnerability is actively exploited in the wild.
What to do: Organizations should review the CISA alert and apply necessary updates.
CVEs: CVE-2026-104286
Critical Infrastructure
The group tracked by Symantec as Longlegs, also known as Storm-2603, has deployed Warlock ransomware against Critical Infrastructure operators and several other organizations. Over the past two months, these attackers targeted at least four entities in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America, including two critical infrastructure operators, a water utility, a telecommunications provider, a regional government body, and a university. The attackers disabled security software and deployed the ransomware via the domain’s SYSVOL share, having previously exploited ToolShell zero-day vulnerabilities in Microsoft SharePoint.
Why it matters: Organizations suffered ransomware infections and potential data theft.
What to do: Organizations should secure SYSVOL and monitor for tools designed to disable security software.
CVEs: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771
Also today
Armatura One
CISA has released an Industrial Control Systems advisory regarding multiple vulnerabilities in Armatura One. The disclosed vulnerabilities include a critical unauthenticated flaw affecting the product.
What to do: Review the CISA advisory for Armatura One and apply necessary mitigations.
CVEs: CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594
Sources
Tags: fortinet-fortimail, critical-infrastructure, armatura-one