Cybersecurity Weekly Roundup : 5–12 October 2026
1. Fortinet FortiMail Zero-Day Actively Exploited in the Wild
A critical vulnerability affecting Fortinet FortiMail email security appliances was actively exploited by attackers. The vulnerability, tracked as CVE-2026-104286, is a path-traversal flaw involving improper handling of NULL characters. It allows unauthenticated remote attackers to write arbitrary files to vulnerable appliances through specially crafted HTTP or HTTPS requests.
F5 Labs reported active exploitation and highlighted suspicious files, unusual administrative commands, and indicators associated with compromised appliances. The vulnerability received a CVSS score of 9.8.
CVE ID: CVE-2026-104286 (CVSS 9.8)
Why It Matters: FortiMail appliances protect organisational email communications and may hold sensitive messages, credentials, and information about connected systems. Successful exploitation could compromise the email security gateway and provide attackers with opportunities to steal information or establish further access.
Actions: Apply the relevant Fortinet security updates immediately. If patching cannot be completed immediately, follow Fortinet's recommended mitigation guidance, including disabling the affected Identity-Based Encryption functionality where applicable. Review FortiMail logs and filesystem activity for suspicious files, unexpected administrative commands, and unusual outbound connections. Investigate any signs of compromise before closing the incident.
2. AhsayCBS Vulnerabilities Exploited to Deploy Web Shells and Cryptominers
Threat actors were observed exploiting two vulnerabilities in AhsayCBS, a backup management platform commonly used by managed service providers and system integrators. According to Huntress, exploitation began on 7 October 2026 and affected multiple organisations.
The attack chain combines CVE-2026-105133, an authentication-bypass vulnerability, with CVE-2026-105134, which enables operating-system command injection. Following successful exploitation, attackers deployed Java Server Pages (JSP) web shells, conducted system reconnaissance, and installed XMRig cryptocurrency-mining software. Huntress subsequently reported a hotfix addressing the initial entry point on 12 October.
CVE IDs: CVE-2026-105133 and CVE-2026-105134
Why It Matters: Backup management platforms can provide access to backup infrastructure, sensitive organisational data, and systems managed by service providers. Compromise could allow attackers to establish persistence, consume system resources for cryptocurrency mining, and potentially use privileged access to disrupt recovery operations.
Actions: Apply the relevant AhsayCBS hotfix for the deployed version. Restrict management-interface access to trusted networks and review application logs for authentication bypasses and suspicious command execution. Search for unexpected JSP files, unusual child processes, and cryptocurrency-mining activity. If compromise is suspected, isolate affected systems, investigate persistence, and rotate potentially exposed credentials.
Source: Huntress – Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
3. Critical Cisco Nexus Switch Vulnerabilities Could Allow Remote Code Execution
Cisco disclosed multiple critical vulnerabilities affecting its NX-OS operating system, which runs on Nexus 3000 and Nexus 9000 Series switches. The vulnerabilities affect features including NX-API and network operations and maintenance functionality.
Depending on the vulnerability and configuration, a remote unauthenticated attacker could execute arbitrary code with root privileges or cause a denial-of-service condition. Cisco published its security advisories on 7 October 2026 and updated them on 8 October. Exploitation depends on the relevant vulnerable feature being enabled.
CVE IDs: CVE-2026-76471, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 and CVE-2026-76465
Why It Matters: Nexus switches provide connectivity for enterprise data centres and critical network infrastructure. A compromised switch could affect network availability, expose sensitive traffic, or allow attackers to interfere with communications between business-critical systems.
Actions: Identify affected Nexus switches and verify their NX-OS versions and configurations against Cisco's security advisories. Upgrade to the appropriate fixed releases. Disable vulnerable features where they are not required and follow Cisco's recommended mitigation guidance. Monitor management interfaces, device logs, and network telemetry for suspicious requests, unexpected configuration changes, and unexplained device reloads.
4. Foxit Reader Vulnerabilities Could Enable Arbitrary Code Execution
Cisco Talos published research on vulnerabilities affecting Foxit Reader, including flaws that could lead to code execution when a user opens a malicious document. One vulnerability, CVE-2026-57256, affects the JavaScript checkbox functionality in Foxit Reader. Another, CVE-2026-91799, is a use-after-free vulnerability that can result in memory corruption and arbitrary code execution.
These vulnerabilities demonstrate how maliciously crafted PDF documents can be used to target users through commonly deployed document-reading software. Cisco Talos stated that the vulnerabilities covered in its report had been patched by the relevant vendors.
CVE IDs: CVE-2026-57256 and CVE-2026-91799
Why It Matters: PDF readers are widely used in financial services, healthcare, education, and government environments. Successful exploitation could allow an attacker to execute malicious code in the context of the affected application, potentially leading to endpoint compromise or further access to organisational resources.
Actions: Update Foxit Reader to the appropriate fixed version. Review endpoint security alerts for suspicious Foxit Reader child processes, unexpected script execution, and unusual outbound connections following PDF access. Use endpoint detection and response controls to investigate suspicious document activity and reinforce user awareness around unexpected attachments.
Key Recommendations
Prioritise actively exploited vulnerabilities: Review exposure to CVE-2026-104286, CVE-2026-105133, and CVE-2026-105134. Prioritise remediation according to exploit activity, asset exposure, and business impact.
Secure critical infrastructure: Assess the configuration and patch status of email security gateways, backup management platforms, and data centre switches. Restrict administrative interfaces to authorised networks.
Strengthen endpoint and SIEM monitoring: Monitor for suspicious file creation, web shell deployment, unexpected command execution, authentication anomalies, and unusual outbound connections.
Patch vulnerable applications: Update Foxit Reader and other affected applications to vendor-confirmed fixed versions. Validate successful remediation through vulnerability scans and configuration reviews.
Investigate possible compromise: Patching alone does not remove an attacker's existing persistence. Where exploitation is suspected, investigate affected systems, rotate potentially exposed credentials, and confirm that malicious files and processes have been removed.
