Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

Fortinet FortiMail has a path traversal flaw combined with improper neutralization of a NULL byte (CWE-22 and CWE-158). An unauthenticated attacker can send crafted HTTP or HTTPS requests that write arbitrary files on the underlying system. Successful exploitation can place attacker-controlled content on the appliance and may be used to alter its behavior or persist access. The issue affects Fortinet FortiMail; specific version ranges are not listed in the available data, and CVSS has not yet been scored. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-01, so exploitation in the wild is confirmed, while ransomware use and a public proof of concept are not known.

Do: Apply Fortinet's fixes or mitigations for CVE-2026-104286 immediately, in line with CISA BOD 26-04, and treat internet-exposed FortiMail as highest priority. If a vendor fix is unavailable, restrict HTTP/HTTPS management access or discontinue use. Review systems added to the KEV catalog on 2026-10-01 for unexpected file writes and follow CISA forensics triage requirements.

Cisco Catalyst SD-WAN Manager has a critical flaw in how it manages API session authentication. Improper handling of URI encoding in an HTTP request can bypass an authentication rule that is supposed to restrict a specific API endpoint. An unauthenticated remote attacker can send a crafted HTTP request and gain access to the API with admin privileges, affecting confidentiality, integrity, and availability (CVSS 9.8). Organizations that run Catalyst SD-WAN Manager are affected; the provided data does not list vulnerable or fixed version ranges. No public proof-of-concept is known and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

Do: Install Cisco's fixed release for Catalyst SD-WAN Manager as soon as it is available for your deployment; the supplied data does not name vulnerable or fixed versions. Until patched, keep the Manager API off the internet and limit it to trusted management networks, and review API logs for unexpected unauthenticated requests that reach admin-only endpoints.

CVE-2026-85102 is an improper certificate trust-validation flaw (CWE-295) in the VPN negotiation code of Check Point Quantum Security Gateways. An unauthenticated remote attacker who can reach the gateway's VPN service can trigger the flaw during VPN negotiation, where certificates involved in the exchange are not properly validated, and achieve code execution on the gateway. Successful exploitation yields arbitrary code execution on the gateway with high impact on confidentiality, integrity, and availability (CVSS 9.8), amounting to full compromise of the security gateway. The affected population is organizations running Quantum Security Gateways with VPN services reachable from untrusted networks. As of the available reporting there is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is confirmed; the issue was disclosed alongside a second, similarly rated (9.8) Check Point VPN certificate-validation RCE flaw.

Do: Upgrade Quantum Security Gateways to the fixed versions listed in Check Point's advisory (AV26-902) as soon as they are published, prioritizing internet-facing VPN gateways. Until patched, restrict exposure of VPN negotiation endpoints to trusted networks and monitor VPN services for anomalous handshake activity. Inventory which gateways in your estate expose VPN services publicly and treat those as the highest-priority targets.

CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV.

Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.

This vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server, achieving high confidentiality, integrity, and availability through directory traversal and file upload attacks. An attacker can leverage this flaw to compromise sensitive systems and gain extensive control over the management environment. The affected scope includes all Check Point Management Server installations, with no specific version range identified in the provided data.

Do: Upgrade to patched Check Point Management Server versions immediately; disable/block directory traversal and file upload features; audit all management server deployments and verify plugin installation status; monitor for new CVEs and update policies.

An improper input validation flaw (CWE-20) in the on-premises VeloCloud Orchestrator (VCO) allows a remote, unauthenticated attacker to reach privileged internal functionality on the orchestrator host. Exploitation occurs over the network with no credentials or user interaction (attack complexity is high), and success compromises the confidentiality, integrity, and availability of the orchestrator and the data it manages; the CVSS 4.0 vector also flags high impact on subsequent systems, meaning the SD-WAN edges and sites the orchestrator controls are at risk. Affected deployments are customer-operated on-prem VCO installations, while the vendor-hosted (including Dedicated) VCO service was also impacted but has already been patched. No public proof of concept or in-the-wild exploitation has been reported, and the issue is not on CISA's KEV list.

Do: Update on-prem VCO to the fixed release specified in the Arista/Broadcom security advisory as soon as possible. Until patched, remove internet exposure by placing the orchestrator behind a VPN or IP allowlist, and audit logs for unauthenticated or anomalous API requests. Confirm hosted/Dedicated tenancies are on the current patched build and review managed edge devices for unauthorized configuration changes.

F5 BIG-IP Access Policy Manager (APM) contains a heap-based buffer overflow (CWE-122) that is reachable when a virtual server has both an APM access policy and an OAuth profile configured. An unauthenticated remote attacker can send specifically crafted malicious traffic to such a virtual server and achieve remote code execution on the BIG-IP system, which fully compromises the confidentiality, integrity, and availability of the traffic-management device. Systems running in Appliance mode are also vulnerable, and because this is a data plane flaw, the exposure is at the virtual server itself rather than the management control plane. The vulnerability is rated critical (CVSS 4.0: 9.3) with no privileges or user interaction required. No public proof-of-concept or confirmed in-the-wild exploitation is known, and F5 has not evaluated software versions that have reached End of Technical Support.

Do: Inventory virtual servers with an APM access policy plus an OAuth profile and prioritize patching those first, applying the fixed release identified in F5's advisory (EoTS versions must be upgraded to a supported release to receive a fix). Until patched, remove the OAuth profile from internet-facing virtual servers where feasible or restrict access to the virtual server so untrusted sources cannot reach the APM listener. Monitor BIG-IP logs for anomalous traffic to APM-enabled virtual servers, since exploitation would not touch the management plane.