CISA has confirmed that attackers are exploiting these 4 vulnerabilities. If you use any of the products below, check that the fixes are installed today.
Zammad GmbH Zammad (CVE-2026-102489)
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Fortinet FortiMail (CVE-2026-104286)
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Cisco Catalyst SD-WAN Manager (CVE-2026-76504)
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Apple Multiple Products (CVE-2026-86950)
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Keep a backup that is not connected
Ransomware encrypts what it can reach. A backup that is offline, or kept by a service that holds old versions, is the one that saves you.
Doing it once, properly
Saving now often means paying twice: cut-price IT work is frequently rebuilt from the start, and the outage or breach before the rebuild is the expensive part.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-102489 on the National Vulnerability Database
- CVE-2026-104286 on the National Vulnerability Database
- CVE-2026-76504 on the National Vulnerability Database
- CVE-2026-86950 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.