cybr.cx Daily Digest — October 02, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-104286 | Fortinet FortiMail | No CVSS listed (KEV)
An unauthenticated attacker can write arbitrary files to the underlying system via crafted HTTP/HTTPS requests, exploiting a path traversal combined with a NULL byte neutralisation flaw. CISA's remediation deadline was yesterday — if you haven't patched, assume exposure. FortiMail sits at the edge of many enterprise networks; arbitrary file write at that position is effectively pre-auth RCE in practice.

⚠️ Actively exploited — CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | No CVSS listed (KEV)
A hex-encoding quirk in URI handling lets an unauthenticated remote attacker authenticate as the admin user — no credentials required. SD-WAN Manager controls routing policy across entire branch networks, so this is a blast-radius-maximising bug. CISA's patch deadline was yesterday; treat any unpatched instance as compromised until proven otherwise.

⚠️ Actively exploited — CVE-2026-86950 | Apple iOS, macOS, iPadOS — CoreGraphics | No CVSS listed (KEV)
An out-of-bounds write in CoreGraphics can lead to arbitrary code execution and is being actively exploited in the wild. Today is CISA's remediation deadline. Every unmanaged Apple device in your estate — including personal phones on corporate Wi-Fi — is a live risk right now. Push the Apple update immediately.

⚠️ Actively exploited — CVE-2026-88771 & CVE-2026-88772 | Citrix NetScaler ADC / Gateway | No CVSS listed (KEV)
Two concurrent flaws: one allows unauthenticated arbitrary command execution via improper input validation; the other enables RCE or DoS through an out-of-bounds memory operation. NetScaler sits at the front door of countless enterprise environments. Both passed their CISA patch deadlines — scan your ADC inventory now and check for signs of lateral movement originating from the appliance.

⚠️ Actively exploited — CVE-2026-87902 | WordPress Core | No CVSS listed (KEV)
A remote file inclusion flaw lets an unauthenticated attacker hijack page-template resolution to include arbitrary local .php files outside the theme directory, leading to RCE. With WordPress powering a third of the web, opportunistic mass exploitation is virtually guaranteed. Update core immediately and audit server-side PHP file permissions.

⚠️ Actively exploited — CVE-2026-67279 | MikroTik RouterOS | No CVSS listed (KEV)
An unauthenticated client can open an SSH session channel and issue exec requests due to improper workflow enforcement — and CISA explicitly notes this chains with CVE-2026-86060 for unauthenticated exploitation. MikroTik devices are ubiquitous in ISP and SMB infrastructure. Patch deadline has passed; isolate management interfaces and audit for unexpected exec history.

⚠️ Actively exploited — CVE-2026-65660 | Microsoft SharePoint | No CVSS listed (KEV)
A code injection vulnerability allows an authorised network attacker to execute arbitrary code on SharePoint servers. "Authorised" here means any user with SharePoint access — a low bar in most organisations. On-premises SharePoint deployments should be patched immediately; SharePoint Online customers should verify Microsoft has applied mitigations server-side.

⚠️ Actively exploited — CVE-2026-71362 | Adobe Commerce / Magento | No CVSS listed (KEV)
An incorrect authorisation flaw grants elevated access to sensitive resources with no user interaction required. E-commerce platforms are high-value targets for skimmer implantation and payment data theft. Patch deadline has passed — audit admin panel access logs for anomalous activity.

⚠️ Actively exploited — CVE-2026-5430 | WSO2 API Control Plane, API Manager, Traffic Manager, Universal Gateway | No CVSS listed (KEV)
A path traversal enables unrestricted file upload, with a clear path to RCE. WSO2 products are deeply embedded in API infrastructure across financial services and government sectors. If you're running any of these products on-premises, this should be your top patching priority after the Fortinet and Cisco items above.

CVE-2026-19807 | WordPress — ByteCoreStack MCP Connector | CVSS 8.8 — HIGH
The MCP Connector plugin's user-meta write tool gates access with a check that WordPress core collapses to the read primitive when the target user ID matches the current user — effectively meaning any Subscriber can escalate to higher privileges. MCP-connected AI tooling is a rapidly expanding attack surface; review all AI integration plugins in your WordPress deployments.

CVE-2026-95687 | WordPress — WPC Shop as a Customer for WooCommerce | CVSS 8.8 — HIGH
Any authenticated user can impersonate a WordPress Administrator by directly supplying an admin's user ID during session issuance — the plugin never validates the target role. On WooCommerce stores this translates directly to payment configuration access and potential skimmer deployment. Disable or update to a patched version immediately.

CVE-2026-12540 & CVE-2026-12541 | Foreman | CVSS 8.2 — HIGH
Two separate command injection paths in foreman-rake tasks: the errors:fetch_log task passes request_id unsanitised to a shell command, while db:dump and db:import_dump pass destination/file parameters directly to system(). Exploitable by any user with sudo rights to run rake tasks — a common configuration in Foreman deployments. Restrict rake task execution permissions as an immediate interim measure.

CVE-2026-103250 | n8n (MongoDB Chat Memory node) | CVSS 8.1 — HIGH
Unauthenticated attackers can inject MongoDB query operators via the sessionId parameter to read, write, or delete other users' conversation histories. Affects n8n before 1.123.80 and several 2.x ranges. AI workflow automation platforms storing sensitive conversation data are juicy targets — patch or disable the MongoDB Chat Memory node until updated.

CVE-2026-103283 | Ghost CMS (versions 6.20.0–6.57.0) | CVSS 8.1 — HIGH
Improper session management allows any authenticated staff user to authenticate as another staff member using only a password — entirely bypassing two-factor authentication. This is a particularly ugly flaw because 2FA is often the primary compensating control protecting Ghost admin panels. Update to 6.57.1 immediately.

Headline News

Star Blizzard Deploys "RedFlick" Technique to Deliver CosmicPulse Backdoor

Russian state actor Star Blizzard has been observed using a newly documented malware delivery technique dubbed "RedFlick" to install its CosmicPulse backdoor on targeted systems. RedFlick appears designed to evade conventional detection by manipulating how initial-stage payloads are staged and executed, reducing the observable footprint during the delivery phase. CosmicPulse has previously been linked to espionage campaigns targeting government bodies, think tanks, and defence-adjacent organisations in NATO member states. Practitioners should update detection rules to account for RedFlick's staging behaviour and review endpoint telemetry for unusual process ancestry chains that don't match known CosmicPulse signatures. Given Star Blizzard's history of patient, targeted intrusions, organisations in the policy and defence research sectors should treat this as a direct-threat advisory.

Breach of Defence Manpower Data Center Exposes 2.8 Million Military Personnel Records

A months-long intrusion into the Defence Manpower Data Center resulted in the theft of personal records belonging to approximately 2.8 million living current and former U.S. military personnel and staff, with an additional 300,000 records for deceased individuals also exfiltrated. The duration of the breach — spanning multiple months before detection — suggests the attackers achieved persistent access and had significant time to map and exfiltrate data methodically rather than opportunistically. Records of this type — containing identity, service history, and potentially security clearance information — are operationally valuable for foreign intelligence services conducting targeting, social engineering, and identity-based attacks against current and former personnel. Security teams supporting defence contractors and veterans' services organisations should anticipate a surge in highly personalised spearphishing attempts leveraging this data. The breach also raises pointed questions about detection capabilities within federal HR infrastructure.

DIVD Network Breached via Zero-Day Chain in Zammad Ticketing System

In an ironic turn, the Dutch Institute for Vulnerability Disclosure — an organisation dedicated to finding and responsibly disclosing security flaws — had its own network breached through a chained pair of zero-day vulnerabilities in the open-source Zammad ticketing system. The attack exploited two previously unknown flaws in sequence, with attackers reportedly using AI-assisted techniques to accelerate lateral movement once inside. Zammad is widely deployed by security operations teams, IT service desks, and vulnerability coordination bodies — exactly the environments where the data held within the ticketing system is most sensitive. The incident is a sharp reminder that the tooling used by defenders is itself a high-value target, and that internally-facing platforms often receive less security scrutiny than customer-facing ones. Organisations running Zammad should review their deployment immediately and monitor for patches addressing the zero-days.

Schrödinger's Feed

Caltech physicists have experimentally demonstrated a long-sought method for identifying W states — a particularly robust form of multi-photon quantum entanglement where the loss of any single photon doesn't destroy the entangled relationship between the remaining particles. This property makes W states notably more resilient than GHZ states for real-world applications, and the ability to reliably measure them opens new possibilities for quantum teleportation and quantum communication networks. The breakthrough was theoretically predicted decades ago, and actually observing it in the lab marks a meaningful step toward practical quantum networking infrastructure. For practitioners tracking the post-quantum timeline: more reliable entanglement measurement accelerates progress toward quantum key distribution at scale — the technology that will eventually make "harvest now, decrypt later" attacks either irrelevant or urgently relevant depending on who gets there first.

/dev/random

The OpenID Foundation's identity management framework for agentic AI systems has been circulating this week, and it raises a delightfully thorny problem: when an AI agent acts on your behalf, spawns sub-agents, and those sub-agents call APIs — whose identity is actually being used, and who's accountable when it goes sideways? The document grapples seriously with delegation chains, token propagation, and the question of whether an agent should inherit full user permissions or receive narrowly scoped credentials for each task. It's essentially OAuth scoping philosophy applied to entities that can autonomously decide to do new things mid-task. The practical punchline: we've spent thirty years trying to get humans to use least-privilege, and now we're building systems that autonomously request their own permissions. What could go wrong.