---
title: "Security digest: October 1, 2026"
url: https://erroneo.us/security/2026-10-01/
description: "October 1, 2026 vulnerability digest: 1 brief (FortiMail CVE-2026-104286: Exploited Pre-Auth…); 1 CISA KEV addition (Fortinet); 12 critical advisories (npm…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-01
date_modified: 2026-10-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 1, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 12 critical advisories.

## Take stock

- Act now: FortiMail CVE-2026-104286: Exploited Pre-Auth File Write . Anyone running FortiMail 7.2, 7.4, 7.6 or 8.0 as an appliance or VM, most urgently where the webmail or IBE interface is reachable from the internet.
- Do you run any of these? Fortinet FortiMail. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-04.
- npm: 11 critical advisories ( vm2 , piscina ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/siyuan-note/siyuan/kernel ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [FortiMail CVE-2026-104286: Exploited Pre-Auth File Write](https://erroneo.us/security/briefs/fortimail-ibe-path-traversal-cve-2026-104286/index.md): If you run a self-managed FortiMail, upgrade today and check Fortinet's indicators; this is an unauthenticated file-write zero-day on an internet-facing mail gateway.

## Known exploited (CISA KEV)

- [CVE-2026-104286](https://erroneo.us/security/cve/CVE-2026-104286/index.md) Fortinet FortiMail: Fortinet FortiMail Path Traversal Vulnerability (CISA due 2026-10-04)

## Critical advisories

- [CVE-2026-92948](https://erroneo.us/security/cve/CVE-2026-92948/index.md) vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape — npm vm2 >= 3.9.6, <= 3.11.6 → 3.11.7
- [CVE-2026-92940](https://erroneo.us/security/cve/CVE-2026-92940/index.md) vm2 exposes host HTTPS credentials and TLS traffic through globalAgent — npm vm2 >= 3.11.3, <= 3.11.6 → 3.11.7
- [CVE-2026-92951](https://erroneo.us/security/cve/CVE-2026-92951/index.md) vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package — npm vm2 <= 3.11.6 → 3.11.7
- [CVE-2026-92941](https://erroneo.us/security/cve/CVE-2026-92941/index.md) vm2 NodeVM can replace the host process TLS trust store — npm vm2 >= 3.11.3, <= 3.11.6 → 3.11.7
- [CVE-2026-92935](https://erroneo.us/security/cve/CVE-2026-92935/index.md) vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE — npm vm2 >= 3.11.4, <= 3.11.6 → 3.11.7
- [CVE-2026-92957](https://erroneo.us/security/cve/CVE-2026-92957/index.md) vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process — npm vm2 <= 3.11.6 → 3.11.7
- [CVE-2026-92938](https://erroneo.us/security/cve/CVE-2026-92938/index.md) vm2 allows a sandboxed plugin to execute native code through `node:sqlite` — npm vm2 >= 3.11.3, <= 3.11.6 → 3.11.7
- [CVE-2026-102992](https://erroneo.us/security/cve/CVE-2026-102992/index.md) piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env — npm piscina >= 5.0.0, < 5.3.2 → 5.3.2; npm piscina < 4.9.4 → 4.9.4; npm piscina >= 6.0.0-rc.1, < 6.0.0-rc.5 → 6.0.0-rc.5
- [CVE-2026-92937](https://erroneo.us/security/cve/CVE-2026-92937/index.md) vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection — npm vm2 = 3.11.6 → 3.11.7
- [CVE-2026-92939](https://erroneo.us/security/cve/CVE-2026-92939/index.md) vm2 crypto builtin loads attacker native code through setEngine — npm vm2 >= 3.11.3, <= 3.11.6 → 3.11.7
- [CVE-2026-69085](https://erroneo.us/security/cve/CVE-2026-69085/index.md) SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking — Go github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721043339-eef10568384e → 0.0.0-20260721043339-eef10568384e
- [CVE-2026-92944](https://erroneo.us/security/cve/CVE-2026-92944/index.md) vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector — npm vm2 >= 3.10.2, <= 3.11.6 → 3.11.7

---
Source page: https://erroneo.us/security/2026-10-01/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt