Daily brief · 2026-10-03
Zammad Under Active Attack + 4 More Fixes
Zammad
The Cybersecurity and Infrastructure Security Agency has added two vulnerabilities affecting Zammad to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. The first is a session fixation flaw, while the second involves improper privilege management. Although Zammad initially stated they could not confirm the issue, they later acknowledged receiving the details from researchers. Exploiting these vulnerabilities requires prior server access.
Why it matters: Attackers can escalate privileges or execute remote code.
What to do: Apply the updates provided by the vendor.
CVEs: CVE-2026-102489, CVE-2026-102490
Cisco Catalyst SD-WAN Manager
Cisco has confirmed the active exploitation of a vulnerability in its Cisco Catalyst SD-WAN Manager. The company became aware of the exploitation in September 2026, and the flaw has since been included in the federal Known Exploited Vulnerabilities catalog. In response, Cisco provided a temporary Live Protect shield to help mitigate the issue.
Why it matters: An unauthenticated, remote attacker can access the system with admin privileges.
What to do: Apply software updates or deploy the temporary Live Protect shield.
CVEs: CVE-2026-76504
Citrix NetScaler ADC and Gateway
Federal authorities updated their alert concerning exploited zero-day vulnerabilities in Citrix NetScaler ADC and Gateway. The updated advisory provides a new detection rule resource to assist defenders in identifying potentially suspicious activity. Both vulnerabilities independently enable remote code execution, and at least one is being actively exploited in the wild.
Why it matters: Attackers can execute arbitrary code on the affected systems.
What to do: Review the SIGMA detection rule and apply patches.
CVEs: CVE-2026-88771, CVE-2026-88772
Rejetto HTTP File Server
Security researchers reported observing active exploitation of a Rejetto HTTP File Server vulnerability. Their intelligence team began tracking this exploitation on October 1, 2026, prompting the addition of the flaw to their vulnerability catalog.
Why it matters: An unauthenticated attacker can exploit a predictable session signing key to forge an administrator session, and from there achieve remote code execution on the current 3.x line of the server.
What to do: VulnCheck counted roughly 100 vulnerable instances exposed to the internet. Restrict access or patch affected systems.
CVEs: CVE-2026-61500
Microsoft Exchange Server
Microsoft published an advisory for an elevation-of-privilege vulnerability affecting Microsoft Exchange Server. Due to weak authorization, an authenticated attacker can elevate privileges over a network. This flaw could ultimately allow an attacker to gain access to the mailboxes of other users.
Why it matters: Attackers can read email messages and attachments of other users.
What to do: Apply the relevant Microsoft security update.
CVEs: CVE-2026-96940
Sources
Tags: zammad, cisco-catalyst-sd-wan-manager, citrix-netscaler-adc-and-gateway, rejetto-http-file-server, microsoft-exchange-server