Weekly report — week 2026-40

Added to CISA KEV (confirmed exploitation)

• CVE-2026-88779High · 7.5KEVCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityOct 4, 2026
• CVE-2026-102489Critical · 9.8KEVPublic exploitZammad GmbH Zammad Session Fixation VulnerabilityOct 2, 2026
• CVE-2026-102490High · 7.8KEVZammad GmbH Zammad Improper Privilege Management VulnerabilityOct 2, 2026
• CVE-2026-104286Critical · 9.8KEVPublic exploitFortinet FortiMail Path Traversal VulnerabilityOct 1, 2026
• CVE-2026-76504Critical · 9.8KEVPublic exploitCisco Catalyst SD-WAN Manager Hex Encoding VulnerabilitySep 30, 2026
• CVE-2026-86950High · 8.8KEVPublic exploitApple Multiple Products Out-of-Bounds Write VulnerabilitySep 29, 2026

Critical CVEs published (KEV and highest EPSS first)

• CVE-2026-104286Critical · 9.8KEVPublic exploitFortinet FortiMail Path Traversal VulnerabilityEPSS 2.2%
• CVE-2026-105134Critical · 10.0KEVPublic exploitAhsay AhsayCBS Command Injection VulnerabilityEPSS 1.8%
• CVE-2026-76504Critical · 9.8KEVPublic exploitCisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityEPSS 1.8%
• CVE-2026-102489Critical · 9.8KEVPublic exploitZammad GmbH Zammad Session Fixation VulnerabilityEPSS 1.3%
• CVE-2026-104019Critical · 9.0OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified StudioEPSS 1.4%
• CVE-2026-102106Critical · 9.1Kiteworks Email Protection Gateway improper authenticationEPSS 1.1%
• CVE-2026-102115Critical · 9.8Kiteworks Core Authentication Bypass in the Password Reset WorkflowEPSS 1%
• CVE-2026-84411Critical · 9.8MikroTik RouterOS Integer UnderflowEPSS 0.9%
• CVE-2026-87115Critical · 9.1VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' ParameterEPSS 0.9%
• CVE-2026-102102Critical · 9.1Kiteworks Email Protection Gateway server-side request forgeryEPSS 0.8%
• CVE-2026-105105Critical · 9.8Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltrationEPSS 0.8%
• CVE-2026-105135Critical · 10.0InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injectionEPSS 0.8%
• CVE-2026-51862Critical · 9.1DB-GPT 0.8.0 contains directory traversal in skill_upload…EPSS 0.7%
• CVE-2026-96658Critical · 9.9Foreman: safemode bypass leading to rceEPSS 0.7%
• CVE-2026-102104Critical · 9.1Kiteworks Email Protection Gateway server-side request forgeryEPSS 0.7%
• CVE-2026-102103Critical · 9.1Kiteworks Email Protection Gateway server-side request forgeryEPSS 0.7%
• CVE-2026-91012Critical · 9.8Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege EscalationEPSS 0.6%
• CVE-2023-54405Critical · 9.8H3C CVM Unauthenticated File Upload via fileUpload/upload TokenEPSS 0.6%
• CVE-2025-41753Critical · 9.8Path traversal in dynamically created BACnet File ObjectsEPSS 0.6%
• CVE-2026-103877Critical · 9.8Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue...EPSS 0.6%

Biggest EPSS increases (30-day exploitation probability)

Nothing this week.

New public exploits and templates

Nothing this week.