erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: October 1, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 12 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: FortiMail CVE-2026-104286: Exploited Pre-Auth File Write. Anyone running FortiMail 7.2, 7.4, 7.6 or 8.0 as an appliance or VM, most urgently where the webmail or IBE interface is reachable from the internet.
  • Do you run any of these? Fortinet FortiMail. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-04.
  • npm: 11 critical advisories (vm2, piscina). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/siyuan-note/siyuan/kernel). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-104286

FortiMail CVE-2026-104286: Exploited Pre-Auth File Write

If you run a self-managed FortiMail, upgrade today and check Fortinet's indicators; this is an unauthenticated file-write zero-day on an internet-facing mail gateway.

Must act: Anyone running FortiMail 7.2, 7.4, 7.6 or 8.0 as an appliance or VM, most urgently where the webmail or IBE interface is reachable from the internet.

Can relax: FortiMail Cloud customers, whom Fortinet patched on Oct 5, 2026, and organizations that do not run FortiMail.

  1. List every FortiMail appliance and VM and check its firmware with get system status.
  2. Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later; move 7.2 systems to 7.4.9 or later.
  3. If you cannot upgrade today, disable the IBE service (config system encryption ibe, set status disable, end) or remove internet access to the webmail interface.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-104286Fortinet FortiMail
Fortinet FortiMail Path Traversal Vulnerability		2026-10-04

Critical advisories by ecosystem 12

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 11

Check: npm audit (or: npm ls <package>)

Go 1

Check: govulncheck ./...