Every exploited-vulnerability addition of the first week of October landed in something that authenticates remote users or carries their mail, including a third NetScaler flaw that reached appliances patched days earlier for the previous two. A federal advisory also moved the FortiBleed credential operation into ransomware delivery, which changes what an affected organisation in India has to do about it.
1
Fortinet FortiMail exploited for unauthenticated file write — CVE-2026-104286
India exposureRated 9.8. Path traversal with improper null-byte handling lets an unauthenticated attacker write files to the underlying system through a crafted HTTP request. Fortinet records exploitation in the wild. FortiMail fronts mail for Indian enterprises, public sector undertakings and state departments, so what is exposed is the gateway that sees every message.
ActionMove to 8.0.2, 7.6.7 or 7.4.9 and later. Until then disable identity-based encryption, restrict webmail access to trusted networks, and filter POST requests carrying ../. A file write implies persistence, so look for unexpected files and new administrative accounts.
SourceFortinet PSIRT FG-IR-26-175 and CISA Known Exploited Vulnerabilities catalogue, 1 October 2026, remediation date 4 October; Help Net Security, 2 October 2026.
2
Update: a third NetScaler flaw reached appliances patched days earlier — CVE-2026-88779
India exposureThe 2 October edition covered CVE-2026-88771 and CVE-2026-88772. This one, disclosed 4 October, is a memory overflow rated 8.7 on CVSS v4 where NetScaler ADC or Gateway runs as a SAML service provider or identity provider. Citrix observed targeted attacks on unmitigated deployments, and watchTowr assessed it works purely as a crash tool, which pairs it with the earlier two. SAML-fronted NetScaler carries remote access across Indian banking, insurance and IT services.
ActionUpgrade to 14.1-73.41 or 13.1-64.28 and later. Where SAML is not configured, confirm that from the configuration. Web shells reported in the September campaign remain a separate problem from this patch.
SourceCitrix security bulletin and CISA KEV catalogue, 4 October 2026, remediation date 7 October; Sophos, 4 October; Tenable and SecurityWeek, 5 October 2026.
3
Update: FBI and Secret Service tie FortiBleed credentials to ransomware intrusions — JCSA-20261006-01
India exposureThis feed covered FortiBleed in June as credential theft. The advisory of 6 October records more than 86,644 FortiGate firewalls and SSL VPN gateways across 194 countries with working stolen credentials, and names access brokers supplying INC, Lynx and Payload ransomware. The new detail is operational: attackers change passwords and delete administrator accounts while keeping their own access, so some organisations lose control of the appliance. FortiGate SSL VPN is widely deployed across Indian mid-market, manufacturing and multi-branch finance.
ActionReset every VPN and administrator credential, not only those that look suspicious. Restrict external management to trusted hosts, enforce phishing-resistant multi-factor authentication, and confirm administrative accounts use PBKDF2 rather than the legacy SHA-256 storage this operation depends on.
SourceFBI and US Secret Service joint advisory JCSA-20261006-01, 6 October 2026; Cyber Security News, 7 October; Infosecurity Magazine, 8 October 2026.
4
Cisco Nexus switches take unauthenticated root code execution — CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501
India exposureThree flaws at 9.8, all from improper validation of incoming IP traffic where NGOAM is enabled on Nexus 3000 and 9000 series switches in standalone NX-OS mode. An attacker can run code as root without authentication, or force a reload. Cisco found them internally and reported no known malicious use. These switches carry the data centre fabric: colocation estates, BFSI cores, large campus networks.
ActionEstablish whether NGOAM is enabled and disable it where it is not needed, which is Cisco's workaround. Use the Cisco Software Checker for the fixed release on your train. Nexus 7000, MDS 9000 and Nexus 9000 in ACI mode are unaffected.
SourceCisco security advisories, 7 October 2026; BleepingComputer, 8 October 2026.
5
Atlassian Data Center file read moved from patch to reported exploitation in two days — CVE-2026-21589
India exposureRated 9.3 on CVSS v4. Double-colon sequences are treated as path separators in web-resource handling, so an unauthenticated attacker who knows a file's exact name and path can read it from the application web root. Eight self-hosted products are affected, among them Bitbucket, Confluence, Jira Software, Jira Service Management and Bamboo. Atlassian reported no evidence of exploitation on 5 October; VulnCheck added the flaw to its own exploited list on 7 October after observing activity against Bamboo Data Center. Indian IT services firms and captive centres run these at scale.
ActionPatch each product to its fixed release: Confluence 9.2.26 or 10.2.19, Jira Software and Jira Service Management 10.3.26 or 11.3.12, Bitbucket 10.2.8 or 10.5.1, Bamboo 10.2.24 or 12.1.12. Cloud instances need no action. Treat anything readable from the web root as disclosed and rotate it.
SourceAtlassian security advisory, 5 October 2026; Rapid7, 7 October 2026; Infosecurity Magazine, 8 October 2026. Each of these sits between a user and the network behind it, and in most the only fix is an upgrade. That leaves sequencing as the main decision a defender still has. The FortiBleed advisory is the corrective worth keeping: it describes organisations that patched and still lost the appliance, because the credentials had already changed hands. A patch closes the entry. It does not return what went through it. — Nirad Threat Research
