Pentagon Breach, Citrix NetScaler and FortiMail Zero-Days Headline This Briefing

Security leaders should know that the Pentagon's Defense Manpower Data Center disclosed a breach affecting 2.76 million living individuals and 294,000 deceased individuals, while CISA added actively exploited Citrix NetScaler, FortiMail and Zammad vulnerabilities to its Known Exploited Vulnerabilities catalog. Separately, a coordinated Eurojust operation disrupted the KillSec ransomware group, and Microsoft's 2026 Digital Defense Report warns that AI is cutting the time from vulnerability discovery to weaponization to well below 24 hours.

Pentagon's DMDC discloses breach exposing data on 3 million-plus people

The Pentagon's Defense Manpower Data Center is notifying people after unauthorized users accessed a file-sharing system holding personal data from October 2025 until discovery on July 16, 2026. The breach affects 2.76 million living individuals, including current and former defense personnel and dependents, plus 294,000 deceased individuals. Exposed data includes Social Security numbers, birth dates, contact information, race, sex and job specialties. DMDC says it has no indications of misuse and is offering 12 months of free credit monitoring through IDX. (Help Net Security)

CISA adds Zammad zero-days used in agentic-AI breach to KEV catalog

CISA added two Zammad vulnerabilities, CVE-2026-102489 (session fixation enabling remote code execution) and CVE-2026-102490 (privilege escalation to root), to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The additions follow a disclosed agentic-AI attack that used both flaws together to breach the Dutch Institute for Vulnerability Disclosure, hijacking sessions and escalating privileges in seconds. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws on internet-facing systems that grant full control post-exploitation. (CISA)

Critical FortiMail zero-day under active exploitation, patch pending

Fortinet confirmed a critical zero-day, CVE-2026-104286 (CVSS 9.8), is being exploited in FortiMail, its email security gateway, allowing unauthenticated attackers to write arbitrary files via crafted HTTP or HTTPS requests. The flaw affects FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 and 7.2.0-7.2.9; fixed versions have not yet shipped. CISA added the bug to its KEV catalog the same day and set an October 4, 2026 remediation deadline for federal agencies. Until patches arrive, Fortinet recommends disabling the IBE feature or blocking internet access to the management interface. (Help Net Security)

Cisco's fifth SD-WAN zero-day of the year exploited in the wild

For the fifth time this year, Cisco confirmed active exploitation of a zero-day, CVE-2026-76504, in Catalyst SD-WAN Manager, the central console for its software-defined WAN product. An API authentication bypass lets attackers send a crafted HTTP request to gain admin-level API access without credentials. The flaw affects releases 26.2, 26.1, 20.18, 20.15, 20.12, 20.9 and earlier. Patches exist for 20.9 through 26.2; there is no workaround for earlier releases. CISA added the CVE to its KEV catalog and ordered federal agencies to remediate and perform a compromise assessment by October 3, 2026. (Help Net Security)

CISA amplifies global exploitation of critical Citrix NetScaler zero-days

CISA is amplifying Citrix's disclosure of eight new NetScaler ADC and Gateway vulnerabilities, adding two of them, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities catalog. Both are critical, zero-day flaws that can independently enable remote code execution, and CISA says threat actors are actively exploiting them worldwide. Because patching NetScaler appliances can require downtime, the agency is urging organizations to check for signs of compromise and preserve forensic evidence before applying updates, which may erase forensic visibility. (CISA)

Eurojust-led operation disrupts KillSec ransomware group

A coordinated operation led by Eurojust resulted in three arrests and the seizure of five servers linked to KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide since 2024. A 16-year-old is suspected of acting as the group's administrator and main operator. Authorities searched locations in Spain, Greece, the UK and Romania, and secured at least 110 terabytes of stolen data. Judicial authorities from nine countries, including the US and UK, coordinated the action, which Europol supported with cryptocurrency tracing. (Help Net Security)

Microsoft: AI is shrinking the gap between bug discovery and exploitation

Microsoft's 2026 Digital Defense Report, covering July 2025 to June 2026, warns that AI is compressing the time between vulnerability discovery and exploitation to well below 24 hours, with CVEs on track to hit an estimated 72,000 for the year. Phishing accounted for 23% of investigated intrusions, up from 7% a year earlier, and exploitation of public-facing applications rose from 15% to 24%. Microsoft says state actors from China, Russia, Iran and North Korea are all folding AI into reconnaissance, malware creation and social engineering. (Help Net Security)