CISA Adds Zammad, FortiMail, Cisco Flaws to KEV as Pentagon Breach Hits 3M

Security leaders should note two developments first: the Pentagon's Defense Manpower Data Center disclosed a breach touching 2.76 million living individuals and 294,000 deceased individuals, and Mandiant and Google Threat Intelligence Group reported suspected state-sponsored actors have exploited a Citrix NetScaler zero-day since early September. CISA also added Zammad, FortiMail, and Cisco SD-WAN Manager vulnerabilities to its Known Exploited Vulnerabilities catalog this week, while an agentic AI attack used two of those same Zammad flaws to breach a Dutch vulnerability-disclosure nonprofit.

CISA adds two actively exploited Zammad vulnerabilities to KEV catalog

CISA added two new Zammad GmbH vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 2, 2026, citing evidence of active exploitation. The entries are CVE-2026-102489, a session fixation vulnerability, and CVE-2026-102490, an improper privilege management vulnerability. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant attackers total control post-exploitation. (CISA)

CISA adds FortiMail path traversal flaw to KEV catalog

CISA added Fortinet's FortiMail path traversal flaw, CVE-2026-104286, to its Known Exploited Vulnerabilities Catalog on October 1, 2026, based on evidence of active exploitation. The vulnerability is a frequent attack vector for malicious cyber actors and poses significant risk to the federal enterprise. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of such high-risk, publicly exposed vulnerabilities and check for prior compromise before patching. (CISA)

CISA adds Cisco SD-WAN Manager zero-day to KEV catalog

CISA added a Cisco Catalyst SD-WAN Manager flaw, CVE-2026-76504, described as a hex encoding vulnerability, to its Known Exploited Vulnerabilities Catalog on September 30, 2026, based on evidence of active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant attackers total control after exploitation, and to check whether systems were already compromised before patches are applied. (CISA)

Suspected state-sponsored actors exploit second NetScaler zero-day

Mandiant and Google Threat Intelligence Group say suspected state-sponsored actors have exploited a second Citrix NetScaler zero-day, CVE-2026-88772, since early September 2026, hitting dozens of organizations across North America and Europe in government, financial services, education, telecommunications, and legal and professional services. The flaw bypasses authentication and crashes the NetScaler Packet Processing Engine to gain root-level access, after which attackers deployed web shells and a custom tunneling tool. Mandiant's Charles Carmakal warned that patching alone will not remove attackers already inside, since stolen credentials remain a risk. (Help Net Security)

Agentic AI attack uses Zammad zero-days to breach Dutch disclosure nonprofit

An agentic AI-powered attack breached the Dutch Institute for Vulnerability Disclosure on September 21, 2026, by exploiting two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, to hijack sessions, run code remotely, and escalate from a standard user to root in seconds, then access other services and exfiltrate data. DIVD reported the incident to the Dutch Data Protection Authority, the national NCSC, and police, and is still determining what data was accessed. It advises Zammad users to upgrade to version 7 or take affected instances offline, since both flaws remain unfixed. (Help Net Security)

Pentagon's DMDC discloses breach touching more than 3 million people

The Pentagon's Defense Manpower Data Center is notifying people after hackers accessed personal data belonging to 2.76 million living individuals and 294,000 deceased individuals, stored on a file-sharing server. DMDC discovered the security vulnerability on July 16, 2026, and determined that unauthorized users had accessed unencrypted files between October 2025 and the date of discovery. Exposed data included Social Security numbers paired with names, birth dates, contact information, race, sex, and military job specialties. DMDC says it has no indication the information was misused and is offering affected individuals 12 months of free credit monitoring through IDX. (Help Net Security)

OpenInfra Europe's Artifactory instance breached via authentication bypass

OpenInfra Europe, the regional hub of the OpenInfra Foundation, says attackers compromised its self-hosted JFrog Artifactory instance at artifactory.nordix.org by exploiting CVE-2026-82329, an authentication bypass vulnerability, to gain admin privileges. The organization says the compromise began around August 31, 2026, but was not discovered until September 15, after a legitimate user was denied access. Anyone who downloaded or installed artifacts from the instance between August 28 and September 15, 2026 should treat them as potentially compromised and remove them from pipelines. The full scope of the incident remains undetermined. (Help Net Security)