Daily brief · 2026-10-06
Fortinet FortiMail Under Active Attack + 4 More Fixes
Fortinet FortiMail
Fortinet FortiMail contains a path traversal vulnerability that is currently being exploited in the wild. An improper limitation of a pathname to a restricted directory and improper neutralization of a null byte vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Why it matters: Unauthenticated attackers can write arbitrary files to the underlying system.
What to do: Apply the provided workaround or patch.
CVEs: CVE-2026-104286
Citrix NetScaler ADC and Gateway
CISA has added a vulnerability affecting Citrix NetScaler to its Known Exploited Vulnerabilities catalog. Citrix NetScaler ADC and Citrix NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service, and this vulnerability is confirmed as actively exploited.
Why it matters: This vulnerability can lead to a denial of service.
What to do: Apply the updates provided by the vendor.
CVEs: CVE-2026-88779
Zammad
Zammad has two vulnerabilities that were added to the CISA KEV catalog for active exploitation. Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user, and a privilege escalation vulnerability, which can be chained together.
Why it matters: These vulnerabilities can lead to remote code execution and privilege escalation.
What to do: Apply patches as remediation is required by October 5, 2026.
CVEs: CVE-2026-102489, CVE-2026-102490
Atlassian Data Center products
Atlassian published an advisory for a critical arbitrary file access vulnerability affecting multiple Atlassian Data Center products. This arbitrary file access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Why it matters: Attackers can gain access to specific files within the web application root directory.
What to do: Patch to a fixed version or apply temporary mitigations.
CVEs: CVE-2026-21589
Danish CPR system
Unauthorized actors accessed the personal data of approximately 8.8 million registered citizens in the Danish CPR system. By abusing a Danish company’s legal access to search for information in the system, the attackers gained access to names, addresses, and CPR numbers.
Why it matters: The incident resulted in the exposure of names, addresses, and CPR numbers.
What to do: Do not hand out passwords or confidential information if asked.
Sources
Tags: fortinet-fortimail, citrix-netscaler-adc-and-gateway, zammad, atlassian-data-center-products, danish-cpr-system