NetScaler Mass Exploitation, FortiMail Zero-Day, and New Breach Disclosures

Security leaders need to act on two urgent vulnerability advisories today: CISA's addition of CVE-2026-88779, a Citrix NetScaler flaw tied to appliance crashes after a recent patching spree, and Fortinet's critical FortiMail zero-day CVE-2026-104286, already exploited in the wild. Alongside these, a Daiwa Securities contractor breach exposing roughly 110,000 customers, a China-aligned phishing campaign against AI policy experts, and a new White House AI task force round out a busy week for CISOs.

CISA flags new exploited NetScaler flaw amid appliance crashes

CISA added CVE-2026-88779, a memory-overflow bug in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities catalog after Citrix confirmed targeted attacks on unmitigated deployments that can trigger denial-of-service conditions. Administrators have reported appliance crashes and reboots after patching two separate zero-days, CVE-2026-88771 and CVE-2026-88772, in the same product line, with attackers apparently trying to install webshells. The flaw only affects systems using SAML authentication with Gateway or AAA functionality. CISA has ordered federal civilian agencies to remediate by October 7 and check for signs of compromise. (Help Net Security)

CISA adds two actively exploited Zammad flaws to KEV catalog

CISA added two Zammad GmbH vulnerabilities, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities Catalog on October 2, 2026, based on evidence of active exploitation, flagging a session-fixation flaw and an improper privilege-management flaw in the open-source Zammad helpdesk platform. CISA's Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV-listed flaws on internet-exposed assets that grant attackers full control after exploitation, and to check for prior compromise before patching. Organizations running Zammad for customer support or ticketing should treat both vulnerabilities as urgent and verify their deployments. (CISA)

Critical FortiMail zero-day under active exploitation

Fortinet warned that attackers are actively exploiting a critical zero-day, CVE-2026-104286, in its FortiMail email security gateway, a path-traversal and NULL-byte flaw that can let an unauthenticated attacker write arbitrary files on the underlying system. The bug carries a CVSSv3 score of 9.8 and affects FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9; fixes are not yet released. CISA added the flaw to its KEV catalog and set an October 4, 2026 deadline for federal agencies. Until patches ship, Fortinet recommends disabling FortiMail's identity-based encryption feature or restricting management-interface access. (Help Net Security)

Microsoft rushes out-of-band fix for Exchange Server mailbox flaw

Microsoft shipped an out-of-band security update for Exchange Server fixing a high-severity vulnerability, CVE-2026-96940, that could let an authenticated attacker read emails and attachments belonging to other users within the same organization, though not across tenant boundaries. The flaw was found internally, and Microsoft's Exchange Server Team said it is not aware of active exploitation, but warned this vulnerability class has been exploited before. The update covers Exchange Server Subscription RTM, Exchange Server 2019 cumulative updates 14 and 15, and Exchange Server 2016 cumulative update 23; admins are urged to install it promptly. (Help Net Security)

Daiwa Securities discloses breach affecting 110,000 customers

Daiwa Securities Group disclosed that data on roughly 110,000 customers of its brokerage unit may have been compromised after unauthorized access to a server run by contractor Scala Communications, which handles online customer inquiries. The intrusion occurred between Friday evening and Saturday morning and exposed names, email addresses and account numbers; combined with inquiries lacking personal data, around 220,000 records are potentially affected. Daiwa said the leaked information could not be used to carry out transactions and has not confirmed the data has been disclosed or circulated online. (Nikkei Asia)

China-aligned group impersonates officials to phish US AI policy experts

Proofpoint reported that China-aligned group TA419 ran credential-phishing campaigns in July 2026 against AI policy experts in the US, impersonating a former White House Office of Science and Technology Policy official and an economist. Targets who replied were sent a shortened link leading to a fake OneDrive page using a browser-in-the-browser tool that relayed usernames, passwords, MFA codes and session cookies to the attackers in real time. In February 2026 the group also impersonated a senior Anthropic employee to target a think-tank AI policy analyst, underscoring continued espionage interest in US AI policy circles. (Help Net Security)

Trump names DNI Jay Clayton to head new federal AI task force

President Trump named Director of National Intelligence Jay Clayton to lead a new federal task force on artificial intelligence, which he is calling the "Super Intelligence Force." The announcement follows a White House meeting with top AI company executives who signed a voluntary accord to self-police the technology's development. Other members include FTC chairman Andrew Ferguson, Pentagon chief technology officer Emil Michael, and Office of Personnel Management director Scott Kupor; the group will report to Trump and chief of staff Susie Wiles and plans to engage consumers, public interest groups and critical infrastructure providers. (SecurityWeek (Associated Press))