Covering Mon Sep 28 2026 00:00 UTC – Sun Oct 04 2026 23:59 UTC
9 newly exploited vulnerabilities discovered.
1. New Vulnerabilities Linked to Ransomware
No findings in this category this week.
2. Known Vulnerabilities with New Ransomware Indicators
No findings in this category this week.
3. Critical Zero-day Vulnerabilities
No findings in this category this week.
4. New Actively Exploited Vulnerabilities
CVE-2026-104286 affects Fortinet FortiMail and can allow Remote Code Execution.
Scores: CVSS v3.1 9.8, EPSS 0.02201.
Source: https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/
Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-175
Indicators suggest that this vulnerability was exploited as a zero-day before a patch was available.
CVE-2026-76504 affects Cisco Catalyst SD-WAN Manager and can allow Authentication Bypass.
Scores: CVSS v3.1 9.8, EPSS 0.01575.
Source: https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/
Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
Indicators suggest that this vulnerability was exploited as a zero-day before a patch was available.
CVE-2026-102489 affects Zammad GmbH Zammad and can allow Remote Code Execution.
Scores: CVSS v4 9.4, EPSS 0.01396.
Source: https://www.securityweek.com/zammad-zero-days-exploited-in-ai-powered-divd-hack/
Advisory: https://zammad.com/en/product/releases/
Indicators suggest that this vulnerability was exploited as a zero-day before a patch was available.
CVE-2026-102490 affects Zammad GmbH Zammad and can allow Local Privilege Escalation.
Scores: CVSS v4 9.4, EPSS 0.00629.
Source: https://www.securityweek.com/zammad-zero-days-exploited-in-ai-powered-divd-hack/
Advisory: https://zammad.com/en/product/releases/
Indicators suggest that this vulnerability was exploited as a zero-day before a patch was available.
CVE-2026-61500 affects Rejetto HTTP File Server (HFS) and can allow Remote Code Execution.
Scores: CVSS v4 9.3, EPSS 0.00987.
Source: https://www.theregister.com/security/2026/10/03/anthropics-super-bug-hunting-model-mythos-is-hardcore-good-at-math-as-latest-vuln-under-attack-shows/5300933
CVE-2026-5027 affects Langflow Langflow and can allow Remote Code Execution.
Scores: CVSS v3.1 8.8, EPSS 0.04758.
Source: https://www.helpnetsecurity.com/2026/10/01/google-ai-discovered-vulnerabilities-remote-code-execution/
CVE-2026-86950 affects Apple Multiple Products and can allow Remote Code Execution.
Scores: CVSS v3.1 8.8, EPSS 0.01242.
Source: https://www.darkreading.com/cyberattacks-data-breaches/apple-zero-day-vulnerability-weaponized-targeted-attacks
Advisory: https://support.apple.com/en-us/149226
Indicators suggest that this vulnerability was exploited as a zero-day before a patch was available.
CVE-2026-88779 affects Citrix NetScaler and can allow Denial of Service.
Scores: CVSS v4 8.7, EPSS 0.00276.
Source: https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/
Advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
Indicators suggest that this vulnerability was exploited as a zero-day before a patch was available.
CVE-2026-48842 affects Roundcube Roundcube Webmail and can allow SQL Injection.
Scores: CVSS v3.1 8.1, EPSS 0.00891.
Source: https://securityaffairs.com/199882/security/roundcube-sql-injection-cve-2026-48842-is-now-being-exploited-in-the-wild.html
Summary for the vulnerability management teams:
CVE-2026-104286, CVE-2026-76504, CVE-2026-102489, CVE-2026-102490, CVE-2026-61500, CVE-2026-5027, CVE-2026-86950, CVE-2026-88779, CVE-2026-48842
Sourced from CISA KEV, Five Eyes cybersecurity agencies, the NVD/CVE List, EPSS, and more than 15 other reputable external sources.
Full archive: https://signals.mostexploited.com/weekly/2026-w40/
Vulnerability intelligence focused on exploitable vulnerabilities.