ThreatScope

Cisco SD-WAN, FortiMail, Zammad & Apple Security Risks | September 30 – October 6, 2026

Reporting period: September 30 – October 6, 2026
Threat level: High for affected and exposed systems

🎧 Listen to this week’s ThreatScope (audio brief)

Executive Snapshot

This week’s ThreatScope focuses on vulnerabilities affecting network administration, email security, helpdesk infrastructure and Apple devices.

The highest operational priority is Cisco Catalyst SD-WAN Manager, where Cisco has confirmed active exploitation of an authentication bypass that can provide administrative API access.

Fortinet FortiMail also requires immediate attention following reported exploitation of a vulnerability allowing unauthenticated arbitrary file writes. Zammad presents a more complex remediation case involving two separate vulnerabilities in a reported attack chain. For Apple CoreGraphics, the priority is narrower but important: Apple reports possible exploitation in sophisticated attacks against selected individuals.

Is This Report Relevant to Your Organization?

This report is particularly relevant if your organisation operates:

The operational priority should be based on affected version, external reachability, configuration, exposure period and the value of the systems or data accessible through the affected platform.

Executive Summary

Five vulnerabilities require attention this week.

Cisco Catalyst SD-WAN Manager CVE-2026-76504, rated CVSS 9.8, allows an unauthenticated remote attacker to obtain administrative API access through improper handling of URI encoding. Cisco confirms exploitation during September, and affected releases are vulnerable regardless of configuration. 

Fortinet FortiMail CVE-2026-104286, also rated CVSS 9.8, can allow an unauthenticated attacker to write arbitrary files through crafted HTTP or HTTPS requests. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on October 1. Patch availability should be verified against current vendor guidance rather than assumed from announced future releases. 

For Zammad, two vulnerabilities need to be tracked separately. CVE-2026-102489 was reported as enabling session hijacking and code execution as the Zammad service account. CVE-2026-102490 can then allow local privilege escalation from that account to root. Importantly, the reviewed vendor information does not establish that upgrading to Zammad 7.2.0 resolves both issues. 

Finally, Apple CoreGraphics CVE-2026-86950 can allow arbitrary code execution when a malicious file is processed. Apple reports possible exploitation in sophisticated attacks against selected individuals, while CISA added the vulnerability to KEV on September 29. 

Key Vulnerabilities

Vulnerability Analysis

Cisco Catalyst SD-WAN Manager. CVE-2026-76504

Status: Confirmed active exploitation | CVSS 9.8

Improper handling of URI encoding allows an unauthenticated remote attacker to gain administrative API access.

Cisco confirms exploitation during September. Affected releases are vulnerable regardless of configuration, making version and reachability the main exposure questions.

Corrected releases include:

Cisco Live Protect provides temporary, partial protection, but an upgrade remains necessary. 

Required Response

Restrict management access to approved administrative networks and upgrade affected managers.

Preserve relevant logs before disruptive remediation. Review administrative API activity, configuration changes, accounts, policies and integrations. Cisco specifically identifies relevant service-proxy and vManage logs for investigation, but individual indicators should not be interpreted in isolation because some may also occur during legitimate operations.

An unexplained administrative or configuration change should be investigated before the incident is considered closed. 

Fortinet FortiMail. CVE-2026-104286

Status: Reported active exploitation | CISA KEV | CVSS 9.8

Crafted HTTP or HTTPS requests can allow an unauthenticated attacker to write arbitrary files to the underlying system.

Affected versions identified in the research include:

• FortiMail 8.0.0–8.0.1
• FortiMail 7.6.0–7.6.6
• FortiMail 7.4.0–7.4.8
• FortiMail 7.2.0–7.2.9

CISA added CVE-2026-104286 to KEV on October 1.

There is an important operational detail. The reviewed CERT-FR advisory lists 8.0.2, 7.6.7 and 7.4.9 as upcoming releases, rather than confirming them as available downloads. Patch availability should therefore be checked against current Fortinet guidance before remediation plans are based on those versions. 

Required Response

Remove public access to administrative interfaces and check Fortinet advisory FG-IR-26-175 for the current workaround and release status.

Preserve appliance logs and configuration. Investigate unexpected files, new administrator accounts, changes to mail routing and unusual outbound connections.

If compromise is confirmed, follow vendor-supported recovery procedures and rotate exposed credentials from a trusted system. 

Zammad. CVE-2026-102489 & CVE-2026-102490

Status: Reported exploitation in an attack chain

This case requires more careful interpretation than a simple patch recommendation.

DIVD reports that CVE-2026-102489 enabled session hijacking followed by code execution as the zammad service account. CVE-2026-102490 then allowed privilege escalation from that local account to root.

The second vulnerability cannot independently provide remote access. An attacker first needs access to the server. 

Zammad states that versions 7.0 and later are not exploitable through CVE-2026-102489 because of their runtime environment, while version 7.2.0 includes additional hardening and is the recommended upgrade.

However, the reviewed vendor statement does not establish that version 7.2.0 fixes both vulnerabilities. The two CVEs should therefore remain separate in remediation tracking. 

Required Response

Upgrade unsupported and vulnerable legacy installations and restrict access during migration.

Review service-account execution, privilege changes, scheduled tasks, SSH keys and unexpected processes. Where compromise is suspected, revoke active sessions and rotate accessible secrets after containment.

Also assess access to ticket attachments, customer information and integration secrets. Helpdesk systems often contain operational information and credentials supplied during support interactions, increasing the potential impact of a compromise. 

Apple CoreGraphics. CVE-2026-86950

Status: Possible targeted exploitation | CISA KEV

CVE-2026-86950 is an out-of-bounds write in CoreGraphics that can allow arbitrary code execution when a malicious file is processed.

Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28 and reports possible exploitation in a sophisticated attack against selected individuals using versions before iOS 27.

Applicable macOS updates identified by the Canadian Cyber Centre include Tahoe 26.7.1 and Sequoia 15.8.1. 

Required Response

Verify installed builds through device management rather than relying only on update policies.

Prioritise executives, administrators and personnel handling sensitive information, and include personally owned devices that are permitted to access corporate resources.

Suspected targeted compromise should receive specialist investigation. The absence of ordinary endpoint alerts alone is not sufficient to exclude compromise in this type of case. 

What Deserves Attention This Week?

Network Administration

Priority: Cisco Catalyst SD-WAN Manager
Focus: internet reachability, fixed versions, administrative API activity and unexplained configuration changes.

Email Security

Priority: Fortinet FortiMail
Focus: exposed administrative interfaces, unexpected file writes, account changes, mail-routing changes and current vendor remediation status.

Helpdesk Infrastructure

Priority: Zammad
Focus: legacy installations, session compromise, service-account execution, privilege escalation and access to ticket data or integration secrets.

High-Risk Apple Users

Priority: Apple CoreGraphics
Focus: actual installed builds, executives and administrators, personally owned devices with corporate access and suspected targeted activity.

Recommended Management Actions

Immediate Actions: 0–7 Days

• Identify affected Cisco, FortiMail, Zammad and Apple assets.
• Restrict exposed administrative interfaces.
• Upgrade affected Cisco SD-WAN Manager installations.
• Verify the current Fortinet mitigation and patch status before deployment.
• Prioritise vulnerable legacy Zammad environments.
• Deploy applicable Apple security updates, starting with high-risk users.
• Preserve evidence before disruptive remediation.
• Complete compromise triage for exposed systems.
• Investigate unexpected administrative and configuration changes.
• Rotate credentials or secrets where exposure is supported by evidence or reasonably suspected.

Actions Within 30 Days

• Independently verify fixed versions and mitigations across all relevant systems.
• Complete documented compromise assessments for exposed network managers, email gateways and helpdesk systems.
• Resolve remaining legacy Zammad installations.
• Review access to ticket attachments, customer information and integration secrets where Zammad exposure existed.
• Confirm that FortiMail remediation follows current authoritative vendor guidance.
• Verify device-management coverage for corporate and permitted personally owned Apple devices.
• Review centralised logging and retention for the affected technologies.
• Document evidence gaps that limit the confidence of investigations.

Strategic Actions: Within 90 Days

• Improve inventory of internet-accessible management interfaces.
• Reduce unnecessary administrative exposure.
• Include externally managed and legacy applications in vulnerability-management processes.
• Strengthen centralised logging for network management, email security and helpdesk infrastructure.
• Review how credentials and secrets are shared through support systems.
• Improve device-management coverage for privileged and high-risk users.
• Define closure criteria that distinguish remediation, compromise assessment and recovery.
• Maintain named owners and review dates where vendor fixes or authoritative guidance remain unresolved.

Enterprise Exposure Assessment

Four questions should guide prioritisation this week:

1. Was the vulnerable system reachable by an attacker?
Check administrative exposure, firewall rules, remote access and historical reachability.

2. What privileges could exploitation provide?
Administrative API access, arbitrary file writes and root-level escalation require different investigation scopes.

3. What could the affected platform expose next?
Consider network configuration, mail flow, support tickets, customer data, credentials and connected services.

4. Do we have enough evidence to assess previous compromise?
Start from the earliest plausible exposure date supported by available evidence. Missing logs and retention gaps should be recorded explicitly rather than interpreted as evidence that compromise did not occur. 

Questions for Leadership

Security and service owners should establish:

• Are any affected Cisco or FortiMail management interfaces accessible from untrusted networks?
• Have the actual running versions been verified rather than inferred from planned updates?
• Are vulnerable or unsupported Zammad installations still operating?
• If Zammad was exposed, what customer information, attachments or credentials could have been accessed?
• Have high-risk Apple users and personally owned devices with corporate access been included in the update process?
• Where compromise is suspected, has evidence been preserved before recovery?
• Are patching and compromise assessment being tracked as separate decisions?

A case should be considered closed only when the fixed version or tested mitigation is verified, unauthorised network access is blocked, the investigation outcome and evidence gaps are documented, and any necessary recovery or credential actions are complete. 

ISO 27001 & ISO 9001 Alignment

The actions in this report support established security and quality-management practices, including:

• asset and vulnerability management;
• secure configuration and change management;
• access control;
• logging and monitoring;
• incident investigation and response;
• credential and secret management;
• corrective action and independent verification;
• documented ownership and residual-risk management.

For exploited or exposed systems, evidence of remediation should include both the technical correction and the outcome of the compromise assessment.

Need Help Assessing Your Exposure?

If your organisation uses any of the technologies covered this week, begin with the actual running version, external reachability, exposure period and privileges available through the affected system.

Where compromise is suspected, the investigation should extend to configuration changes, connected systems, credentials and available historical evidence.

DIAMATIX supports organisations with exposure assessment, continuous security monitoring, Managed Detection and Response as a Service (MDRaaS), Security Operations Center as a Service (SOCaaS) and Incident Response.

Contact DIAMATIX to discuss your environment.

Conclusion

This week’s vulnerabilities affect very different technologies, but each requires the response to extend beyond simply identifying a CVE.

For Cisco Catalyst SD-WAN Manager, confirmed exploitation and administrative API access make exposed managers the immediate priority.

For Fortinet FortiMail, active exploitation requires containment and investigation, while the current availability of vendor corrections should be verified before relying on a specific release.

For Zammad, the two vulnerabilities must remain separate in remediation tracking. Protection against the initial remote-access issue does not establish that the local privilege-escalation issue has been resolved.

For Apple CoreGraphics, prioritisation should reflect the targeted nature of the reported attacks, with particular attention to executives, administrators and users handling sensitive information.

For affected and exposed systems, the practical sequence is:

Identify Exposure → Contain → Remediate → Assess for Compromise → Recover → Validate

Sources

• Cisco Security Advisory
• CISA Known Exploited Vulnerabilities Catalog
• Fortinet Security Advisory FG-IR-26-175
• CERT-FR
• DIVD CSIRT
• Zammad Security Guidance
• Apple Security Updates
• Canadian Centre for Cyber Security

Methodology

ThreatScope by DIAMATIX prioritises verified exploitation, attacker reachability, available privileges and potential operational impact.

A successful update confirms that a known vulnerability has been addressed. It does not establish whether exploitation occurred before remediation. Evidence gaps should therefore remain visible in the final assessment.

Trusted · Innovative · Vigilant