Multiple enterprise zero-days are under active attack right now
It's been a brutal week for enterprise security teams. A critical zero-day in Fortinet's FortiMail is being actively exploited to achieve unauthenticated arbitrary file writes — and US federal agencies were ordered to patch it by October 4. Meanwhile, a devastating F5 BIG-IP flaw that lets attackers forge authentication tokens remains under in-the-wild exploitation, alongside freshly exploited bugs in Check Point, Cisco, and Citrix gear.
If your organization runs any of this infrastructure, this is your patch list for October 2026.
FortiMail zero-day: patch deadline October 4
The Hacker News reports a critical FortiMail vulnerability under active exploitation that allows unauthenticated attackers to write arbitrary files to the system — a classic precursor to full compromise. Investigators have published indicators of compromise, including two malicious IP addresses (79.141.169[.]187 and 45.129.0[.]192) and a set of suspicious files dropped on victims: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and a modified /data/etc/ld.so.preload — the hallmarks of a rootkit-style persistence mechanism.
The US Cybersecurity and Infrastructure Security Agency (CISA) told federal civilian agencies to apply patches or workarounds by October 4, 2026. If you run FortiMail and haven't patched, treat this as an emergency, not a routine update.
F5 BIG-IP CVE-2026-94127: the token-forging nightmare
Tracked as CVE-2026-94127 and rated 9.8 out of 10 on the CVSS severity scale, this heap-based buffer overflow in F5's BIG-IP Access Policy Manager (APM) allows unauthenticated remote code execution — but only in a specific, dangerous configuration: when APM acts as an OAuth authorization server, with an access policy and OAuth profile on the same virtual server.
Why is that configuration so bad to lose? An OAuth authorization server issues access tokens. Compromise it and attackers can forge tokens for any user, any service, any scope — signing in with credentials your own infrastructure considers legitimate. It's persistent, hard-to-detect access that doesn't look like an intrusion.
F5 confirmed the flaw was exploited before the patch existed. CISA added it to its Known Exploited Vulnerabilities catalog on September 22. Key facts for defenders:
- Affected: BIG-IP versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0 (even in Appliance mode).
- Not affected: APM deployments used strictly as OAuth clients or resource servers.
- Fix: F5 engineering hotfixes for each branch (21.1.0.2.0.30.22, 17.5.1.9.0.160.12, 17.1.3.5.0.41.14) — or a temporary iRule from F5 Support that filters malicious OAuth traffic.
- Check for compromise: look for repeated OAuth authentication failures followed by suspicious commands or TMM crashes.
Also under active exploitation this week
- Check Point — CVE-2026-85102 and CVE-2026-93616, including a critical Security Management Server flaw; emergency hotfixes released.
- Cisco Catalyst SD-WAN Manager — CVE-2026-76504 exploited in the wild.
- Citrix NetScaler ADC and Gateway — CVE-2026-88771 and CVE-2026-88772 under attack.
- Arista VeloCloud Orchestrator — CVE-2026-93952 exploited.
What to do right now
For IT admins: inventory every internet-facing appliance — F5, Fortinet, Check Point, Cisco, Citrix — and patch this week, not this quarter. These are not theoretical flaws; exploitation is confirmed and ongoing. After patching, hunt for the published indicators of compromise; a patched-but-already-breached box is still breached.
For everyone else: you can't patch your vendor's load balancer, but you can watch for the downstream effects — unexpected password-reset emails, unfamiliar login alerts, or services behaving oddly — and make sure your own devices and apps are updated. Attackers who own the infrastructure in the middle can reach a long way downstream.
The bottom line
Firewalls, VPNs, and gateways aren't passive plumbing — they're privileged, internet-facing systems, and attackers are treating them as the front door. This week's pile of zero-days is the reminder: patch the edge first.
Disclosure: This post contains affiliate links. If you buy through them, I may earn a commission at no extra cost to you.
Top comments (0)