What landed in CVE-land this week

The signal in this week's CVE flow was not volume. It was two unauthenticated network edges that CISA added to KEV while vendors were still publishing formal advisories. If you run Cisco Catalyst SD-WAN Manager or Fortinet FortiMail, treat the rest of this post as a work order.

Lead: CVE-2026-76504, Catalyst SD-WAN Manager URI encoding auth bypass

Cisco published the Catalyst SD-WAN Manager advisory on 2026-10-05. CISA added it to KEV on 2026-09-30; active exploitation is confirmed. The vulnerability is in API session management: the appliance matches an incoming HTTP request against an authentication rule for admin routes, then dispatches to the handler. The authentication rule's parser and the dispatcher's parser disagree on how to handle hex escapes in the URI. An attacker hex-encodes a character or two in the path, slips past the authentication rule, and still reaches the privileged endpoint after the backend normalises the URI.

The result, in Cisco's own words, is access "with privileges of the admin user" from an unauthenticated, remote source. No credential, no prior foothold, no social engineering. A single crafted HTTP request is enough. That is the archetypal management-plane bug: a device that administers a fleet of SD-WAN edges handing out admin privileges to anyone who can speak HTTP to its web interface.

The attacker takes a protected endpoint such as /dataservice/admin/user and hex-encodes a byte the authentication layer uses to key its deny rule, while the backend normalises the path and routes as usual:

GET /dataservice/%61dmin/user HTTP/1.1
Host: vmanage.example.com
Accept: application/json

The authentication layer, keying off the literal path, does not see /dataservice/admin/. The dispatcher, after normalisation, does. Any admin API call becomes reachable the same way. The pattern mirrors several past URI parser-confusion bugs in network appliance management planes; the specific primitive differs, but the exposure shape is identical.

Three detections to wire up today:

  1. On the vManage front end, log every request whose path contains a percent-encoded alphabetic character (%41 through %7a), not just non-ASCII bytes. Legitimate clients rarely encode a as %61; attackers probing parser disagreements do.
  2. Look for authenticated-shape responses to requests that carry no session cookie or token. In healthy traffic that count is zero. If it is not, assume compromise and rotate.
  3. Alert on new local admin users, new API tokens, and new device templates created from source IPs absent from your change-management records. Post-exploitation on SD-WAN Manager almost always touches those three objects.

Patching is the only mitigation. Cisco's advisory lists fixed versions; there are no workarounds. If the appliance remains exposed to the public internet after this week, that is a decision, not an oversight; reverse it before negotiating patch windows.

Second: CVE-2026-104286, FortiMail path traversal and NULL-byte write

Fortinet FortiMail entered KEV on 2026-10-01. The flaw is a classic pair: path traversal plus improper neutralisation of a NULL byte in the file name component of an HTTP or HTTPS request. An unauthenticated attacker crafts a request that escapes the intended upload directory with ../ segments and embeds a NULL byte to truncate the server-side extension check early. The bytes after the NULL (say, .png) never reach the write path, but the extension check reads the truncated name and approves it. The file lands on disk with the attacker's chosen suffix (.jsp, .php, a crontab entry, a template) intact.

The practical consequence is arbitrary file write by an unauthenticated client, which on a mail gateway almost always escalates to code execution: a web-root write to a servlet directory, a template overwrite consumed on the next request, or a seeded cron spool. A schematic of the probe, not a published payload:

POST /remote/upload HTTP/1.1
Host: mail.example.com
Content-Type: application/octet-stream

filename=..%2f..%2f..%2fvar%2fwww%2fshell.jsp%00.png
<body bytes>

If your FortiMail appliance sits behind a WAF, confirm the WAF normalises %00 and rejects (rather than silently strips) the NULL byte. Silent stripping converts a detectable attack into an invisible one that still reaches the vulnerable code path via internal normalisation on the appliance. Hunt the appliance's own logs for upload requests touching paths outside the designated upload tree, and audit scheduled jobs and web directories for files whose owner, mtime, or hash do not match the vendor baseline.

Also worth knowing

CISA added two chained Zammad bugs on 2026-10-02. CVE-2026-102489 is a session fixation that leads to code execution as the zammad user; CVE-2026-102490 is an improper privilege management flaw that lets the zammad user reach root. Operators running a self-hosted Zammad helpdesk should assume the two are being chained and update immediately. Apple's CoreGraphics out-of-bounds write (CVE-2026-86950) landed in KEV on 2026-09-29 and applies to iOS, iPadOS, and macOS: push the mobile MDM profile.

The remediation posture

For U.S. federal civilian agencies, KEV items fall under CISA BOD 26-04, "Prioritizing Security Updates Based on Risk," which took effect on 2026-06-10 and carries the KEV criteria forward from the previous directive. Private-sector operators are not legally bound by it, but any program that uses KEV as a tripwire for emergency change management is already aligned with its logic. Standing guidance: KEV additions move to the front of the queue, exposure review precedes patching, and every KEV identifier maps to an owner, a maintenance window, and a verification artefact before the ticket closes.

The failure mode across all four CVEs has the same shape: an unauthenticated attacker speaks HTTP to a management interface, exploits a parser inconsistency or input-validation gap, and arrives at root. The defence is straightforward: shrink the attack surface (management planes do not belong on the public internet), patch on vendor cadence, and verify by replaying the attacker's probe against the appliance you just patched. If the probe still succeeds, the ticket is not done.

Verifiable security.