Ivanti Connect Secure zero-day CVE-2026-104935 is exploited and on CISA KEV with an October 16 deadline. Patch now, then investigate: the attack chain hides from Ivanti’s own Integrity Checker.
GitLab fixed CVE-2026-97229, a CVSS 10.0 flaw that may allow unauthenticated code execution on self-managed servers. Upgrade to 19.4.2, 19.3.5 or 19.2.8.
Citrix patched CVE-2026-107406, a CVSS 9.5 NetScaler SAML memory overflow. Builds that fixed last week’s exploited SAML zero-day remain vulnerable in IdP mode. Upgrade to 14.1-73.46 or 13.1-64.29.
Attackers are chaining two AhsayCBS flaws for SYSTEM-level code execution, webshells and cryptomining. Version 10.3.4 remains vulnerable; restrict access and investigate now.
CISA added five legacy vulnerabilities exploited by China-linked actors to KEV, with an October 11 federal deadline. Here is what security leaders should find, patch and investigate now.
Fortinet now lists fixed FortiMail builds for exploited CVE-2026-104286. Its log indicators show a rogue archive account sending data to attacker infrastructure, a change that survives the upgrade.
CVE-2026-61500 lets unauthenticated attackers forge Rejetto HFS administrator sessions and execute code. Probing began days after technical details emerged; HFS 3.2.1 and later contain the fix.
CVE-2026-88779 is an exploited Citrix NetScaler SAML flaw affecting appliances patched only days ago. Review fixed builds, CISA’s October 7 deadline, detection clues and prioritized CISO actions.
Fortinet has released fixed builds for CVE-2026-104286. Upgrade FortiMail now, then check archive accounts, cron activity and files for evidence of compromise.
