Weekly Threat Bulletin – October 7th, 2026

Fortinet FortiMail CVE-2026-104286 Path Traversal Flaw Actively Exploited

A critical path traversal vulnerability in Fortinet FortiMail, tracked as CVE-2026-104286 with a CVSS v3.1 score of 9.8, is being actively exploited to compromise email security appliances. The flaw combines path traversal (CWE-22) with improper neutralization of NULL bytes (CWE-158) within the FortiMail GUI, enabling unauthenticated remote attackers to write arbitrary files and execute unauthorized code via crafted HTTP or HTTPS requests. Affected products include FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. While upcoming security updates will address the flaw in versions 8.0.2, 7.6.7, and 7.4.9, administrators should immediately apply workarounds by disabling Identity-Based Encryption (IBE) via the CLI (`config system encryption ibe`, `set status disable`, `end`) or restricting management interface access to trusted networks. Observed malicious activity is linked to IP addresses 79.141.169.187 and 45.129.0.192, with key indicators of compromise including suspicious files such as `/data/lib/liblog.so`, `/data/bin/webconsole`, and `/data/etc/ld.so.preload`, as well as anomalous log entries involving unexpected `/migadmin` commands and IBE Base64 parsing errors.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify all FortiMail appliances in your environment and upgrade them to a patched version (8.0.2, 7.6.7, 7.4.9, or later) as soon as possible.
• If patching cannot be immediately applied, use the FortiMail CLI to disable the Identity-Based Encryption (IBE) feature with the commands 'config system encryption ibe', 'set status disable', and 'end'.
• Validate that no FortiMail management interfaces are exposed to the public internet. If they are, immediately apply firewall rules to restrict access to only trusted, internal IP addresses.
• Add the IP addresses 79.141.169.187 and 45.129.0.192 to your firewall blocklist to prevent inbound and outbound communication.
• Scan all FortiMail appliances for the existence of the following files and investigate any findings: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload, /bin/smit, /data/etc/httpd.conf, and /data/migadmin.tar.gz.
• Using your SIEM or log management platform, search FortiMail logs for evidence of anomalous activity, including unexpected '/migadmin' commands, IBE Base64 parsing errors, or unusual archive account configurations.

Compliance Best Practices

• Implement and enforce a network security policy that prohibits exposing administrative interfaces of any appliance or server to the public internet. Use jump boxes or VPNs for administrative access.
• Establish a formal vulnerability management program that includes regular, authenticated scanning of all assets, risk-based prioritization of findings, and defined SLAs for remediation.
• Deploy a File Integrity Monitoring (FIM) solution on critical infrastructure, including security appliances like FortiMail, to alert on unauthorized file creation or modification in sensitive directories.
• Enhance SIEM detection capabilities by establishing baselines for normal system and user behavior on critical appliances and creating correlation rules to alert on significant deviations from that baseline.
• Implement and maintain a comprehensive hardware and software asset inventory to ensure you can quickly identify all affected systems in response to vulnerability disclosures.

Citrix NetScaler CVE-2026-88779 Zero-Day Actively Exploited via SAML

Citrix has issued emergency security updates to address a zero-day vulnerability, tracked as CVE-2026-88779 with a CVSS score of 8.7, which affects NetScaler ADC and NetScaler Gateway appliances utilizing SAML authentication with Gateway or AAA functionality. Although officially designated as a memory buffer flaw causing denial-of-service conditions through the repeated crashing of the `nsaaad` and `Pitboss` processes, active exploitation indicates the vulnerability can be leveraged for remote code execution. Security researchers have observed threat actors targeting SAML authentication factors with crafted usernames containing shell commands designed to download malware payloads from the IP address 213.209.159.55, save them to `/v`, and execute them. In response to these active attacks, which prompted the Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities catalog, administrators must immediately upgrade vulnerable deployments to NetScaler versions 14.1-73.41, 13.1-64.28, or their corresponding FIPS-compliant releases.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Run configuration checks on all NetScaler appliances to determine if they are configured as a SAML Service Provider (SP) or Identity Provider (IdP).
• Upgrade all vulnerable NetScaler ADC and Gateway appliances to the patched versions (14.1-73.41, 13.1-64.28, or the appropriate FIPS/NDcPP version) immediately.
• Add the IP address 213.209.159.55 to the network firewall blocklist.
• Review NetScaler appliance logs for evidence of compromise, such as unexpected reboots, repeated crashes of the 'nsaaad' process, and suspicious command strings in authentication usernames.
• Scan the filesystem of all potentially vulnerable NetScaler appliances for a malicious payload file named '/v'.
• Apply the latest 'Global Deny Lists' provided by Citrix to your NetScaler deployments to block known malicious actors.

Compliance Best Practices

• Review and improve the vulnerability management program to shorten the time required to test and deploy emergency patches for critical, internet-facing systems.
• Configure NetScaler appliances to forward all relevant logs, including authentication and system process logs, to a centralized SIEM to enable automated monitoring and alerting.
• Implement and enforce network segmentation policies that isolate internet-facing appliances like NetScaler from the internal corporate network, restricting their access to only essential systems.
• Develop and regularly test an incident response playbook specifically for compromises of network edge devices like NetScaler.

AWS Patches Loom AI Agent Authentication Bypass (CVE-2026-103956) and SageMaker Command Injection

Amazon Web Services (AWS) has released security updates addressing three vulnerabilities in its open-source Loom platform for AI agent orchestration, alongside an OS command-injection vulnerability in Amazon SageMaker Unified Studio. Tracked as CVE-2026-103956, the most severe Loom flaw is an authentication-bypass vulnerability (CWE-306/CWE-1188) affecting versions prior to 1.6.1; it allows unauthenticated network clients to gain administrative control over the agent control plane, register malicious tool servers, and modify IAM policies when no identity provider is configured. CVE-2026-103957 is an OAuth2 discovery-handling flaw (CWE-918/CWE-201) in Loom versions prior to 1.7.0 that permits authenticated users with `mcp:write` or `a2a:write` scopes to exfiltrate client secrets and access tokens via malicious discovery URLs. CVE-2026-103958, also affecting Loom versions prior to 1.7.0, is a server-side request forgery (SSRF) vulnerability in Model Context Protocol (MCP) and agent-to-agent (A2A) connection handling that allows scoped users to redirect backend requests to internal endpoints, potentially exposing temporary cloud credentials. AWS resolved these Loom issues in version 1.7.0 and recommends immediate upgrades or configuring Amazon Cognito/external identity providers as a workaround. Additionally, AWS patched CVE-2026-104019, an OS command-injection vulnerability in the SageMaker Unified Studio Space startup script that could allow contributors to execute arbitrary commands in other members' Spaces and hijack temporary execution-role credentials; this has been addressed via a global fix requiring administrators to restart affected Studio Spaces.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify all AWS Loom deployments and upgrade them to version 1.7.0 or later.
• Identify all Amazon SageMaker Unified Studio Spaces and restart them to apply the patched images that mitigate CVE-2026-104019.
• For any AWS Loom deployments that cannot be immediately upgraded, configure an Amazon Cognito user pool or an active external identity provider to prevent unauthenticated access.
• Scan all AWS Loom deployments to ensure the environment variable `LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV` is not set in any non-development environment.
• Rotate all OAuth2 client secrets used by AWS Loom integrations as a precaution against potential exposure from CVE-2026-103957.
• Force rotation of temporary IAM role credentials associated with AWS Loom and Amazon SageMaker Studio, and review CloudTrail logs for any anomalous activity originating from these services.

Compliance Best Practices

• Review and restrict user permissions within AWS Loom, specifically limiting who has `mcp:write` or `a2a:write` scopes to the minimum necessary personnel.
• Implement a formal review process for assigning 'project contributor' or higher permissions within Amazon SageMaker projects to enforce the principle of least privilege.
• Implement strict network egress filtering for services like AWS Loom to prevent them from making outbound connections to arbitrary internal or external endpoints.
• Develop and implement a formal process to track open-source software components, like AWS Loom, used in our environment and subscribe to their security bulletins.
• Establish and enforce secure configuration baselines for all deployed cloud services, ensuring that services like AWS Loom are never deployed in production with default, unauthenticated access enabled.

China-Nexus Longlegs Uses Microsoft SharePoint Vulnerabilities to Deploy Warlock Ransomware

The China-nexus threat actor Longlegs, also tracked as Storm-2603, is actively targeting critical infrastructure, government, and academic institutions across Portuguese- and Spanish-speaking regions in Europe, Africa, and Latin America, recently compromising a water utility and a telecommunications provider. Initial access is gained by exploiting Microsoft SharePoint Server vulnerabilities to deploy a webshell in the LAYOUTS directory, followed by harvesting ASP.NET machine keys to forge signed payloads. To maintain persistence and move laterally, the group utilizes DLL side-loading, abuses Visual Studio Code's remote tunneling feature, and creates a masqueraded domain account named `SPSEPRDSetup`. Defenses are systematically disabled using the vulnerable signed driver `K7RKScan` to terminate security processes at the kernel level. Ultimately, the threat actor leverages Active Directory SYSVOL replication to distribute and execute the Warlock ransomware domain-wide, recently compromising at least 40 hosts with defense-evasion tools and deploying ransomware on at least 33 hosts.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately identify all on-premises Microsoft SharePoint servers and apply the latest security patches to mitigate the 'ToolShell' vulnerabilities.
• Add all file hashes listed in the article's Indicators of Compromise to your Endpoint Detection and Response (EDR) and antivirus blocklists.
• Block the domains and URLs listed in the article's Indicators of Compromise, such as 'catbox[.]moe' and 'wasabisys[.]com', at the web proxy, DNS filter, and firewall.
• Scan all endpoints and servers for the presence of malicious file names and paths mentioned in the article, such as 'run.exe', 'rune.exe', and 'layout2sp.aspx'.
• Hunt for suspicious command-line activity in security logs, specifically looking for the execution of 'net user /domain', 'whoami', 'nltest /domain_trusts', and 'nxc.exe'.
• Use endpoint security controls, such as Windows Defender Application Control (WDAC), to create a block rule for the vulnerable 'K7RKScan.sys' driver.

Compliance Best Practices

• Implement file integrity monitoring (FIM) on the SYSVOL share to generate alerts for the creation or modification of executable files and scripts.
• Implement a process to continuously audit and alert on any changes to privileged groups, such as local Administrators on servers and Domain Admins in Active Directory.
• Develop and deploy an application control policy using tools like AppLocker or Windows Defender Application Control (WDAC) to restrict the execution of unauthorized applications, scripts, and DLLs.
• Isolate public-facing servers, such as SharePoint, in a dedicated network segment (DMZ) with strict firewall rules that only allow necessary traffic to and from the internal network.
• Review and enable tamper protection features on all Endpoint Detection and Response (EDR) and antivirus agents to prevent them from being disabled or modified by unauthorized users or processes.
• Establish and enforce a policy to disable or restrict the use of remote tunneling features in developer tools like Visual Studio Code on production servers and standard user workstations.
• Enable PowerShell Script Block Logging and Module Logging on all Windows systems and forward these logs to a central SIEM for monitoring and analysis.

Anthropic's Mythos Model Discovers CVE-2026-61500 in Rejetto HFS Under Active Exploitation

A critical authentication-bypass vulnerability, tracked as CVE-2026-61500, has been discovered in Rejetto HTTP File Server (HFS) and is currently undergoing active exploitation in the wild. Discovered using Anthropic's Mythos AI model, the flaw allows attackers to forge valid session cookies and achieve remote code execution by exploiting cryptographic weaknesses in how HFS signs session cookies. Specifically, HFS relies on V8's insecure `Math.random()` pseudo-random number generator (PRNG) using the xorshift128+ algorithm; because the application leaks these outputs, the algorithm is fully reversible, allowing attackers to use a Satisfiability Modulo Theories (SMT) solver like Z3 to recover the PRNG seed. Active exploitation has been observed targeting hosts in the United States and Japan, initially originating from a China-hosted IP address and subsequently routing through US-based proxy IPs within the same subnet (173.239.211.248 and 173.239.211.249). Users of Rejetto HFS are urged to upgrade to version 3.2.1 or later to mitigate this vulnerability.

Severity: Medium

Threat Details and IOCs

Mitigation Advice

• Update all instances of Rejetto HTTP File Server (HFS) to version 3.2.1 or later immediately.
• Use a vulnerability scanner to discover all instances of Rejetto HTTP File Server (HFS) on the network and identify any versions older than 3.2.1.
• Add the IP addresses 173.239.211.248 and 173.239.211.249 to your firewall's blocklist.
• Search all firewall, web server, and network traffic logs for any connections to or from the IP addresses 173.239.211.248 and 173.239.211.249.

Compliance Best Practices

• Establish and maintain a comprehensive software asset inventory to ensure all applications, including open-source software, are tracked and managed.
• Implement a formal vulnerability management program that includes regular scanning, risk-based prioritization, and defined service-level agreements (SLAs) for patching.
• Implement network segmentation to isolate internet-facing servers and services from the internal corporate network.
• Incorporate secure coding training for developers, specifically covering the correct use of cryptographic libraries and the dangers of using non-secure random number generators for security-sensitive functions.