Known exploited vulnerabilities: Sep 28 – Oct 4, 2026

CISA added 6 vulnerabilities to the Known Exploited Vulnerabilities catalog between Sep 28 – Oct 4, 2026: each one is confirmed to be exploited in the wild. 0 are linked to ransomware campaigns, 0 have a public exploit, and 0 have an EPSS score of 10% or more. The catalog now holds 1739 entries.

Fix-first order

Sorted the way exploit-aware triage works: ransomware-linked first, then by EPSS exploit probability.

Scanner: “Active check” means ShadowSecurityScanner ships a network or web probe for this CVE; “Catalog” means it is tracked in the KEV-synced audit catalog and flagged when version fingerprinting matches.

CVE-2026-104286 — Fortinet FortiMail Path Traversal Vulnerability

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

• Added to KEV: 2026-10-01 · CISA due date: 2026-10-04
• EPSS: 2.2% (p82) · Public exploit: none known · Ransomware use: not known
• Weakness: CWE-22, CWE-158
• Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• References: fortiguard.fortinet.com · cisa.gov · cisa.gov · nvd.nist.gov

CVE-2026-76504 — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

• Added to KEV: 2026-09-30 · CISA due date: 2026-10-03
• EPSS: 1.8% (p78) · Public exploit: none known · Ransomware use: not known
• Weakness: CWE-177
• Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• References: sec.cloudapps.cisco.com · cisa.gov · cisa.gov · nvd.nist.gov

CVE-2026-102489 — Zammad GmbH Zammad Session Fixation Vulnerability

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

• Added to KEV: 2026-10-02 · CISA due date: 2026-10-05
• EPSS: 1.3% (p69) · Public exploit: none known · Ransomware use: not known
• Weakness: CWE-384
• Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• References: zammad.com · community.zammad.org · cisa.gov · cisa.gov · nvd.nist.gov

CVE-2026-86950 — Apple Multiple Products Out-of-Bounds Write Vulnerability

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

• Added to KEV: 2026-09-29 · CISA due date: 2026-10-13
• EPSS: 1.2% (p68) · Public exploit: none known · Ransomware use: not known
• Weakness: CWE-787
• Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• References: support.apple.com · support.apple.com · support.apple.com · cisa.gov · cisa.gov · nvd.nist.gov

CVE-2026-88779 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

• Added to KEV: 2026-10-04 · CISA due date: 2026-10-07
• EPSS: 0.6% (p47) · Public exploit: none known · Ransomware use: not known
• Weakness: CWE-119
• Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• References: support.citrix.com · community.citrix.com · cisa.gov · cisa.gov · nvd.nist.gov

CVE-2026-102490 — Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

• Added to KEV: 2026-10-02 · CISA due date: 2026-10-05
• EPSS: 0.5% (p44) · Public exploit: none known · Ransomware use: not known
• Weakness: CWE-269
• Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• References: zammad.com · community.zammad.org · cisa.gov · cisa.gov · nvd.nist.gov

How to find these on your network

Every KEV entry is flagged automatically in ShadowSecurityScanner: findings are sorted KEV → EPSS → severity, and a daily catalog update pulls new KEV entries without a reinstall. See how to run a network vulnerability scan.

Sources: CISA KEV, FIRST.org EPSS, Exploit-DB, Metasploit. · All weekly digests