# Newly exploited vulnerabilities: week of 28 September to 4 October 2026 (week 40)

Source: https://junglewise.ai/threats/exploited/2026-09-28  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 6 October 2026, 00:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-09-28.json  
License: CC BY 4.0 with a link back

In the week of 28 September to 4 October 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Zammad (2), followed by Zammad Gmbh Zammad (2) and Apple Ios (1).

## Newly exploited this week

- [CVE-2026-88779: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before…](https://junglewise.ai/threats/cve-2026-88779-cisa-adds-one-known-exploited-vulnerability-to-catalog) (critical, exploited in the wild, CVSS 7.5, exploited since 4 Oct 2026, published 4 Oct 2026)
- [CVE-2026-102490: Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the) (critical, exploited in the wild, exploited since 2 Oct 2026, published 30 Sep 2026)
- [CVE-2026-102489: Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack) (critical, exploited in the wild, exploited since 2 Oct 2026, published 30 Sep 2026)
- [CVE-2026-104286: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail…](https://junglewise.ai/threats/cve-2026-104286-fortinet-fortimail-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, exploited since 1 Oct 2026, published 1 Oct 2026)
- [CVE-2026-76504: Cisco Catalyst SD-WAN Manager API authentication bypass](https://junglewise.ai/threats/cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication) (critical, exploited in the wild, CVSS 9.8, exploited since 30 Sep 2026, published 30 Sep 2026)
- [CVE-2026-86950: Apple CoreGraphics out-of-bounds write in file processing](https://junglewise.ai/threats/cve-2026-86950-an-out-of-bounds-write-issue-was-addressed-with-improved-bounds) (critical, exploited in the wild, CVSS 8.8, exploited since 29 Sep 2026, published 28 Sep 2026)

## Technologies hit most

1. [Zammad](https://junglewise.ai/threats/technologies/zammad): 2 vulnerabilities
2. Zammad Gmbh Zammad: 2 vulnerabilities
3. Apple Ios: 1 vulnerability
4. [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados): 1 vulnerability
5. [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe): 1 vulnerability
6. [Apple Multiple Products](https://junglewise.ai/threats/technologies/multiple-products): 1 vulnerability
7. [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager): 1 vulnerability
8. [Citrix NetScaler](https://junglewise.ai/threats/technologies/netscaler): 1 vulnerability
9. Fortinet FortiMail: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 28 September to 4 October 2026 (week 40)", https://junglewise.ai/threats/exploited/2026-09-28, 6 October 2026.