[CLSTR]
< Back to all clusters
[TECHNOLOGY] · United States · 10 sources

started · updated

Part of situation: CISA vulnerability exploitation and patching directives (12 clusters)

Fortinet and Cisco report active exploitation of critical zero-day vulnerabilities

zero-day vulnerability FortiMail Cisco Catalyst SD-WAN CISA cybersecurity exploitation

Fortinet and Cisco are addressing critical vulnerabilities that are currently being exploited in the wild.

Fortinet has confirmed the active exploitation of a zero-day vulnerability in FortiMail (CVE-2026-104286). This path traversal flaw, which involves improper handling of NULL bytes, carries a CVSS score of 9.8. It allows unauthenticated attackers to write arbitrary files to the mail gateway via crafted HTTP or HTTPS requests. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to mitigate the issue by October 4, 2026.

Separately, Cisco has confirmed active exploitation of a critical authentication bypass vulnerability in its Catalyst SD-WAN Manager (CVE-2026-76504). This flaw, also rated with a CVSS score of 9.8, allows unauthenticated administrative access through URL encoding bypass. CISA added this vulnerability to its catalog on September 30, 2026, and mandated that U.S. federal agencies remediate the flaw by October 3, 2026.

Entities

CISA · Catalyst SD-WAN Manager · Cisco · FortiMail · Fortinet · Horizon3.ai

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Fortinet warns that critical flaw in FortiMail is facing exploitation [cybernoz.com]
Critical Fortinet FortiMail Zero-Day: CVE-2026-104286 Enables Unauthenticated Arbitrary File Writes [flagthis.com]
El INCIBE-CERT alerta de una vulnerabilidad crítica en FortiMail de Fortinet explotada activamente [www.moncloa.com]
Cisco SD-WAN’s URL Encoding Bypass Grants Unauthenticated Admin Access. Federal Agencies Have 24 Hours. [forkast.news]
FortiMail zero-day exploited in attacks as CISA urges immediate patching [cyberinsider.com]
FortiMail Zero-Day Lets Unauthenticated Attackers Write Files to the Mail Gateway and Is Already Exploited (CVE-2026-104286) | Uganda National Computer Emergency Response Team-National Cert [cert.ug]
Cuatro nuevos avisos de SCI | INCIBE [www.incibe.es]
U. S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog [securityaffairs.com]
U. S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog [securityaffairs.com]
CVE-2026-76504: Cisco SD-WAN Auth Bypass [horizon3.ai]