cybr.cx Daily Digest — October 03, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-102489 & CVE-2026-102490 | Zammad | CVSS: Not scored (KEV)
These two Zammad vulnerabilities are being exploited in the wild right now and are chained together for a devastating attack path. CVE-2026-102489 is a session fixation flaw enabling remote code execution as the zammad user; CVE-2026-102490 then escalates that foothold to full root via improper privilege management. CISA's remediation deadline was October 5 — if you're running Zammad and haven't patched, treat this as an active incident response situation.

⚠️ Actively exploited — CVE-2026-104286 | Fortinet FortiMail | CVSS: Not scored (KEV)
An unauthenticated attacker can write arbitrary files to the underlying system via crafted HTTP/HTTPS requests exploiting a path traversal combined with NULL byte injection. CISA's deadline was October 4 — effectively now. FortiMail sits on the perimeter of most enterprise mail infrastructure; arbitrary file write at this layer is a full system compromise primitive.

⚠️ Actively exploited — CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | CVSS: Not scored (KEV)
A hex encoding flaw in URI handling allows unauthenticated remote attackers to access the management interface with admin-level privileges. No credentials required. SD-WAN managers are high-value targets as they control routing policy across entire WAN fabrics — this is network-wide blast radius territory. Patch or isolate management interfaces immediately.

⚠️ Actively exploited — CVE-2026-88771 & CVE-2026-88772 | Citrix NetScaler ADC & Gateway | CVSS: Not scored (KEV)
Two concurrent NetScaler vulnerabilities in active exploitation: CVE-2026-88771 allows unauthenticated command execution via improper input validation; CVE-2026-88772 enables RCE or DoS through an out-of-bounds memory operation. NetScaler remains one of the most targeted perimeter products year after year — assume anything internet-exposed and unpatched is already being probed.

⚠️ Actively exploited — CVE-2026-86950 | Apple iOS, macOS, iPadOS | CVSS: Not scored (KEV)
An out-of-bounds write in CoreGraphics can lead to arbitrary code execution. The fact this is in the KEV catalogue indicates real-world exploitation, most likely via malicious media or document rendering — a classic spear-phishing delivery vector. MDM-managed fleets should prioritise forced update pushes.

⚠️ Actively exploited — CVE-2026-87902 | WordPress Core | CVSS: Not scored (KEV)
An unauthenticated remote file inclusion flaw in WordPress Core allows attackers to force page-template resolution to include arbitrary local .php files outside theme directories, leading to RCE. With WordPress powering a significant portion of the web, the attack surface here is enormous. Update WordPress Core immediately across all managed instances.

⚠️ Actively exploited — CVE-2026-67279 | MikroTik RouterOS | CVSS: Not scored (KEV)
An improper workflow enforcement flaw lets unauthenticated clients open session channels and send exec requests, chainable with CVE-2026-86060 for unauthenticated exploitation. MikroTik devices are widely deployed in SMB and ISP environments and are frequently incorporated into botnets following compromise. Audit and update all RouterOS devices exposed to the internet.

⚠️ Actively exploited — CVE-2026-65660 | Microsoft SharePoint | CVSS: Not scored (KEV)
A code injection vulnerability in SharePoint allows an authorised attacker to execute arbitrary code over the network. In practice, this means any compromised account with SharePoint access becomes a lateral movement launchpad. Patch and review SharePoint audit logs for anomalous activity.

CVE-2026-15897 | WordPress Super Forms Plugin (≤ 6.3.316) | CVSS 8.8 — HIGH
The Register & Login add-on's before_email_success_msg() function blindly trusts an attacker-supplied user_id parameter during account update flows and passes it directly to wp_update_user() without any ownership or capability check. Any authenticated user can escalate to administrator by supplying a target user's ID. Update the plugin immediately; consider disabling the Register & Login add-on until confirmed patched.

CVE-2026-96940 | Microsoft Exchange Server | CVSS 8.8 — HIGH
Weak authorisation logic in Exchange Server allows an authenticated attacker to elevate privileges over the network. Details are thin, but authenticated privilege escalation on Exchange is a serious risk given Exchange's role as an identity-adjacent system with deep Active Directory integration. Monitor for unusual Exchange management activity and apply available patches.

CVE-2026-82039 | UTMStack (< 11.2.16) | CVSS 8.8 — HIGH
The UtmAssetGroupService.searchQueryBuilder() method constructs PostgreSQL queries via String.format() without sanitising assetType or groupName parameters, enabling authenticated SQL injection via GET /api/utm-asset-groups/searchGroupsByFilter. The irony of a security platform carrying a high-severity SQLi should not be lost — upgrade to 11.2.16.

CVE-2026-104988 | Dogtag PKI (pki-core) | CVSS 8.1 — HIGH
The CMCAuthForEST plugin fails open when an EST enrollment request arrives via BasicAuth without a client TLS certificate. The subsystem's own agent certificate persists in the session, causing downstream checks to treat the request as agent-privileged. Authenticated EST users can thereby obtain agent-level access — a significant privilege boundary breach in PKI infrastructure.

Headline News

Chinese State Actors Impersonate Former US Official to Target AI Researchers

A sophisticated spear-phishing campaign attributed to Chinese threat actors used the impersonated identity of a former senior US government official to harvest email credentials and communications from artificial intelligence researchers. The operation specifically targeted individuals working in advanced AI development — a clear signal that nation-state intelligence collection has pivoted hard toward AI intellectual property as a primary objective. The attackers used the established credibility of the impersonated identity to lower target suspicion, a social engineering technique that bypasses most technical controls. For security teams protecting research institutions and technology companies, this underscores that high-value technical staff — particularly those in AI, semiconductor, or dual-use research — are priority targets requiring additional phishing-resistant authentication controls and communications security hygiene. Assume that any researcher with a public professional profile in these domains is already a named target somewhere.

Linux Kernel Security in the LLM Era: A Maintainer's Perspective

Greg Kroah-Hartman, one of the Linux kernel's longest-serving maintainers, delivered a notable talk addressing the intersection of LLM-generated code and kernel security — a tension that is rapidly becoming a front-line concern for open source security. The core problem: LLMs contribute plausible-looking but subtly flawed code, and the kernel's review process — already strained — is ill-equipped to catch the specific failure modes that machine-generated patches introduce. Kroah-Hartman's perspective carries weight because the Linux kernel underpins virtually all cloud infrastructure, Android devices, and a substantial share of embedded and critical systems globally. Security practitioners should take note that the threat model for open source supply chain security now explicitly includes LLM-assisted code contributions as a novel attack surface, whether through deliberate prompt injection into developer workflows or simply through confident, wrong code that reviewers wave through.

Schrödinger's Feed

Researchers at Oak Ridge National Laboratory have developed LuGo, an algorithm that slashes quantum gate counts for computational fluid dynamics problems by over 95% — by offloading heavy initialisation routines to classical supercomputers like Frontier and feeding only the essential quantum operations to the quantum processor. This hybrid classical-quantum approach is increasingly recognised as the practical path to near-term quantum advantage, bypassing the need to wait for fully fault-tolerant machines. It's a reminder that "quantum supremacy" in practice may look less like a pure quantum computer winning a race and more like a carefully orchestrated relay between classical and quantum hardware. For practitioners tracking cryptographic timelines: advances in hybrid efficiency directly accelerate the point at which cryptographically relevant quantum computation becomes feasible, making PQC migration planning more urgent, not less.

/dev/random

Greg Kroah-Hartman's talk on kernel security in the LLM age surfaced a specific and somewhat alarming observation: developers are now submitting kernel patches written or heavily assisted by LLMs that pass basic review but contain subtle logical errors that a human expert would likely have caught in their own first draft. The Linux kernel — which famously has more review scrutiny than almost any codebase on the planet — is finding that "looks right" and "is right" are diverging in new ways under AI assistance. There's something philosophically rich about a system designed to prevent catastrophic bugs in the world's most critical software now having to defend against bugs that are, in a sense, too fluent to be obviously wrong. The appropriate response, apparently, is the same as it's always been: more careful human review — the one thing LLMs are simultaneously making easier to skip and more necessary than ever.