Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

thehackernews.com Oct 2, 2026

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

Curated by Shubham · TechCapsules · Oct 2, 2026

AI-summarised brief · reviewed before publication

The U.S. Cybersecurity and Infrastructure Security Agency added a critical flaw in Fortinet FortiMail (CVE‑2026‑104286, CVSS 9.8) to its Known Exploited Vulnerabilities catalog after reports of active attacks. The vulnerability permits unauthenticated attackers to write arbitrary files via crafted HTTP/HTTPS requests, exploiting path traversal and NULL‑byte issues. Fortinet confirmed wild exploitation and urged affected customers to apply workarounds or patches by October 4, 2026. The incident follows similar in‑the‑wild exploits on Check Point, Arista, F5, Cisco, and Citrix products.

💡 Why It Matters

· The flaw exposes a broad class of enterprise mail gateways to remote code execution, underscoring the urgency of patching legacy security products before attackers can deploy automated, AI‑driven intrusion tools.

Capsules Cybersecurity

Read full article on thehackernews.com

Why CISOs Struggle to Answer the Board’s Three Hardest Questions, and How…

A new guide proposes a shift from traditional count‑based security reporting to a risk‑centric model that answers board questions about safety, exposure, and ROI. It argues that data from disparate tools—identity, cloud posture, vulnerability scanners, SIEM, EDR—lives in isolated silos, preventing a holistic view of attack paths. By adopting Cybersecurity Mesh Architecture, CISOs can correlate these datasets into a single graph, identify critical assets, map access chains, and quantify risk in financial terms. The guide outlines steps to build such a report, moving from findings to actionable exposure insights.

💡 Boards need to see how security investments translate into reduced risk, not just activity metrics. This approach gives them a clear, financially framed picture of protection and ROI.

blog.barracuda.com · Oct 2

Cybersecurity Awareness Month 2026: Turn security awareness into cyber resilience

Cybersecurity Awareness Month 2026 urges organizations to transform security awareness into year‑round resilience amid a surge of AI‑powered attacks. The National Cybersecurity Alliance and CISA highlight that AI enables faster, more convincing phishing, credential theft, and social engineering. While training remains vital, the campaign stresses layered defenses: strong passwords, multifactor authentication, timely software updates, and vigilance against scams. The 2026 theme, “Don’t Make It Easy for Them,” calls for a culture where security decisions are routine, not optional, to counter the evolving threat landscape.

💡 By embedding security habits into daily operations, companies can preempt AI‑driven breaches that exploit human weaknesses, turning awareness into a proactive shield.

independent.co.uk · Oct 2

Experts issue warning after voice scam AI attacks skyrocket

Microsoft’s latest digital defence report shows a sharp rise in voice‑phishing attacks, with incidents through Teams up 502% year‑on‑year and over 46 million business‑contact impersonations recorded in the past 12 months. The study highlights that 27 % of cyber‑threat activity targets government agencies, and that attackers increasingly use AI for live voice modulation, accent disguise, and counterfeit identity documents that bypass visual checks. The report notes that AI is also being weaponised against machine‑learning models, prompting experts to call for stronger public‑private security collaboration.

💡 The surge in AI‑powered voice scams threatens critical government operations, exposing sensitive data and undermining trust in digital communications. It underscores the urgent need for coordinated security frameworks that address both human and machine‑learning vulnerabilities.

jagwire.augusta.edu · Oct 2

Navigating the 2026 cyber threat landscape

Augusta University warned its community on October 1, 2026 that cybercriminals are leveraging artificial‑intelligence tools to craft more convincing phishing emails, deepfake audio‑visual messages and “quishing” scams that exploit QR codes. Assistant Vice President of Cyber Defense Heather Roszkowski emphasized that trust‑based attacks now outweigh technical exploits, urging staff, faculty and students to verify emails, links and requests before responding. The university highlighted five top threats of the year: AI‑enhanced phishing, realistic deepfakes, compromised credentials from password reuse, automated credential‑stuffing attacks, and QR‑code fraud. It directed users to the internal “Phish Bowl” portal for recent attack examples and provided practical steps—such as scrutinizing urgency cues and avoiding password reuse—to bolster personal and institutional security.

💡 By exposing how AI amplifies social‑engineering tricks, the alert forces a cultural shift toward vigilant verification, directly protecting the university’s data and reputation.

nevadabusiness.com · Oct 1

Securing Nevada

Nevada’s rapid economic expansion has made it a prime target for cyber threats, prompting leaders to emphasize data defense as essential for resilience. State CIO Timothy Galluzi highlighted the state’s growth as a logistics hub, burgeoning data centers, and a massive hospitality sector that collectively store high‑value customer data. President Brian Cushard of LP Insurance Services warned that increased connectivity heightens the risk of disruptions to businesses, public entities, vendors, and critical infrastructure. Experts noted a shift from ransomware to business email compromise, underscoring the evolving threat landscape.

💡 The convergence of Nevada’s booming data‑intensive industries and its attractiveness to attackers underscores the urgent need for robust cyber‑security strategies that protect both economic stability and public trust.

thehackernews.com · Oct 1

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

The U.S. Cybersecurity and Infrastructure Security Agency added the Cisco Catalyst SD‑WAN Manager authentication bypass flaw (CVE‑2026‑76504, CVSS 9.8) to its Known Exploited Vulnerabilities list after reports of active exploitation. The flaw allows an unauthenticated remote attacker to send a crafted HTTP request, bypassing authentication and gaining admin‑level access. Cisco confirmed the issue in September 2026 and released indicators of compromise for affected logs. Federal agencies must patch by October 3, 2026, and organizations are urged to upgrade immediately.

💡 The vulnerability exposes a critical entry point into enterprise‑wide network management, enabling attackers to control entire SD‑WAN infrastructures without credentials. Prompt remediation is essential to prevent widespread lateral movement and data exfiltration.