The IT week was the second ISO. Last week’s NetScaler floor is still in for SAML; Mandiant named WHIPSHOT; FortiMail’s clock expired with firmware still upcoming.

28 September–5 October 2026. Six new KEVs. Citrix 88779 is a SAML overflow that 14.1-73.37 does not close. FortiMail 104286 is due with 8.0.2 still marked upcoming. Zammad’s session-to-root chain is due today.

RWP Ventures · 2026-10-05 · 20 min read · priority 8.9

Executive summary

FACT: Last week the highest-leverage enterprise problem was the appliance that is the internet path — two NetScaler RCEs on KEV, Check Point 85102 flipping from “imminent” to catalog, SharePoint recast from spoofing. This week that same class did not close. The first ISO is not the hunt, and for SAML Gateways it is not even the floor.

CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.04 released 4 October 18:52 UTC, now holds 1,734 rows. Six of those were added between 29 September and 4 October. All six carry forensic triage Yes. Catalog ransomware-use on every new row is Unknown. The material ransomware increment this week is not a new CVE field. It is a campaign report on an old door: Symantec, 1 October, Longlegs (Microsoft Storm-2603) still reaching on-prem SharePoint to deploy Warlock.

Mandiant Consulting and Google Threat Intelligence Group published the NetScaler hunt on 29 September. CVE-2026-88772 has been in since at least early September. The kit is new: WHIPSHOT (PHP web shell, C2 in HTTP headers) and SLAPSHOT (Python TCP tunnel into the internal network). Mandiant: web-server handler changes, SUID on /bin/sh, and dropped PHP can survive an upgrade and can replicate across an HA pair. CISA’s federal due for 88771/88772 was 30 September. That clock expired. The implant class did not.

Citrix then published CTX697174. CVE-2026-88779 is a SAML SP/IdP memory overflow. CISA listed it 4 October. Federal clock 7 October. Floors 14.1-73.41 / 13.1-64.28. Last week’s RCE builds — 14.1-73.37 / 13.1-64.23 — sit inside today’s affected range if the box is a SAML SP or IdP.

Fortinet FG-IR-26-175, retrieved 5 October, still lists 8.0.2, 7.6.7, and 7.4.9 as upcoming. CISA listed CVE-2026-104286 1 October. Federal clock was 4 October. The workaround (disable IBE, pull the GUI, or WAF POST /ibe containing ../) is still the close that exists.

Due today, 5 October: Zammad CVE-2026-102489 and CVE-2026-102490. Due Wednesday: NetScaler 88779.

ASSESSMENT: If the patch queue this week was last week’s 73.37 NetScaler ISO plus leftover Check Point Takes, you sequenced a first build and called it done. The second ISO is the SAML Gateway. The mail gateway still has no ISO. The SD-WAN controller’s May peering patch does not close September’s admin API.

The week in one assessment

Three threads, one pattern: the first patch on an internet-facing control plane is not remediation. NetScaler took a named kit that outlives the RCE ISO, then a SAML overflow that needs a second build. FortiMail took a KEV clock with firmware still marked upcoming. Catalyst SD-WAN Manager took unauthenticated admin on every deployment, and the spring peering floors do not cover it. Attackers keep buying the box that steers other boxes — the ADC that terminates SAML, the mail GUI that writes files, the vManage that templates the WAN — while last week’s SharePoint recast shows up this week as Warlock on a water utility’s IT farm, not as a process event.

1. Most important development

Citrix NetScaler, second week. It is still not a load balancer in this story. It is the WAN-side identity path: SSL VPN, ICA/CVPN, AAA, and now the SAML SP/IdP that mints the assertion other apps trust.

Do not collapse four facts. They are four tickets.

1. WHIPSHOT is what was already on the box. Mandiant/GTIG, 29 September: exploitation of CVE-2026-88772 identified in late September, ongoing since at least early September. Observed impact North America and Europe, across government, financial services, technology, education, and legal and professional services. Frontline telemetry is malformed or fragmented DTLS during the pre-auth handshake, heap corruption in NSPPE, shellcode as root on FreeBSD. Post-exploit is PHP that the appliance’s own httpd will run: .deb registered as PHP under /netscaler/gui/vpn/scripts/linux, or /vpn/media/*.ico aliased to a .sig. The installer sets chmod u+s /bin/sh. WHIPSHOT hides Base64 C2 in HTTP_X_UX headers and forces HTTP 404. SLAPSHOT binds localhost and speaks a length-prefixed JSON tunnel. In at least one intrusion Mandiant watched, the operator used that proxy for manual internal reconnaissance and credential theft. GTIG did not publish a cluster ID. Mandiant CTO Charles Carmakal, quoted in secondary reporting, called the operators “advanced and suspected state-sponsored.” That is REPORTED, not a GTIG attribution. CISA ransomware-use remains Unknown. Do not import last year’s NetScaler ransomware history onto this kit.

1. 88771 is still in, and still a different precondition. Citrix confirmed in-the-wild use of CVE-2026-88771 (unauthenticated command execution, default configuration, no extra feature). GreyNoise retro-tagged 88771 attempts from 149.104.78.141 on 24 September, three days before CTX697096. Turning DTLS off does not close 88771. GreyNoise’s LogonPoint path (.ctxs.receiver, receiver.min.css alias) is related tradecraft, not one implant family, until someone publishes a join.

1. 73.37 is not 73.41. CVE-2026-88779 is a new CVE, a new bulletin (CTX697174, changelog 3 October PST), and a new floor. Citrix CNA: CVSS 4.0 8.7, availability High, confidentiality and integrity None. Precondition: add authentication samlAction or add authentication samlIdPProfile. Default config is not enough. A box without those strings is not this CVE. A box with those strings on 73.37 is. Citrix’s own 3 October blog: if you already installed the 88771–88778 builds and you meet the SAML precondition, upgrade again. CISA listed it 4 October, due 7 October, forensic triage Yes. This is the sixth NetScaler KEV row in 2026 (catalog: 3055, 8452, 19490, 88771, 88772, 88779).

1. Citrix classifies 88779 as DoS. Treat RCE claims as unproven for this CVE. Citrix: targeted attacks on unmitigated deployments; “we have not identified an impact on the integrity of customer data.” Beazley Security, 4 October: investigations confirm a DoS; actors tried to force reboots so 88771 log injection would fire; appliances patched 27 September no longer execute the injected commands; no evidence of code execution on patched systems. Secondary reports that a honeypot later ran a downloaded binary are REPORTED, not a vendor reclassification. Global Deny List signatures are an interim for the narrow band already on 73.37/64.23 but not yet on 73.41/64.28. Citrix still says upgrade. A deny-list counter is not forensic triage, and it does not hunt WHIPSHOT.

CISA revised the 27 September NetScaler alert on 2 October with a SIGMA detection resource. That is a hunt aid for 88771/88772. It is not a close.

There is no confirmed OT or physical-process impact. A NetScaler in front of an industrial remote-access path is still an IT perimeter compromise until evidence says otherwise. We do not have it.

2. Active exploitation

CONFIRMED in KEV this window, catalog 2026.10.04:

Six rows is not six equal stories. Apple 86950 is a client-side out-of-bounds write Meta found; Apple’s exploitation claim is “may have been exploited” against specific targeted individuals on iOS before iOS 27. CISA listed it 29 September. The lagging estate is iOS/iPadOS 26, macOS Sequoia 15, macOS Tahoe 26. It is a real KEV row. It is not the WAN-side control plane.

The control-plane three are NetScaler 88779, FortiMail 104286, and SD-WAN Manager 76504.

FortiMail CVE-2026-104286. Fortinet FG-IR-26-175, 1 October, still the live page this morning: CWE-22 plus CWE-158, unauthenticated arbitrary file write via crafted HTTP or HTTPS, GUI component, CVSS 3.1 9.8, Known Exploited Yes, Virtual Patch No. Timeline on the advisory is still 2026-10-01: Initial publication. Solutions table still says upcoming 8.0.2 / 7.6.7 / 7.4.9. 7.2.0–7.2.9 must migrate to 7.4 or above — into a train whose own floor is still marked upcoming. 7.6.7 release notes (2 October, build 858) say CWE-22 is closed and do not print the CVE. Notes are not the IR. Workarounds on the live page: disable IBE, take webmail/management off the internet, or WAF-block POST /ibe containing ../. Hunt artifacts Fortinet published include added/modified binaries (/data/lib/liblog.so, /bin/smit, /data/bin/webconsole, /data/bin/mailservice), IPs 79.141.169.187 and 45.129.0.192, and a config add of archive account archive234 to that first IP. Named actor: none. Clock expired yesterday. Forensic triage has not.

Cisco CVE-2026-76504. Catalyst SD-WAN Manager, unauthenticated admin API on every deployment, including default configuration. CWE-177, URI encoding of j_security_check (Cisco’s example encodes the letter j as /%6a_security_check; any one encoded character works). CVSS 3.1 9.8. No workaround. Cisco: found during a TAC case, aware of active exploitation in September 2026. This is not May’s peering bypass CVE-2026-20182. Spring floors (20.9.9.1 / 20.12.7.1 / 20.15.4.4 / 20.18.2.2 / 26.1.1.1) sit below today’s 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1. Cloud-managed 20.15.605 is Cisco’s problem. On-prem Managers are the ticket. Clock expired 3 October. Hunt serviceproxy-access.log and vmanage-server.log for encoded j_security_check and viptela-reserved- usernames before treating the build as a close.

Zammad CVE-2026-102489 / CVE-2026-102490. Due today. DIVD is a CNA and the named victim: own network, 21 September, noticed the next day, reported to Zammad 24 September, started notifying other internet-facing owners 26 September. Two bugs chained: session fixation to RCE as zammad, then LPE to root. DIVD: “in seconds.” NCSC-NL (NCSC-2026-0396, 30 September): actively abused at least since 21 September; copy logs before the 489 update. CISA listed both 2 October, notes say they can be chained, forensic triage Yes. The vendor split is the operational fact: Zammad 7.2.0 (23 September) is the session close; Zammad says it has received no technical details on 490 and cannot confirm the LPE. DIVD/NCSC write 6.3.0 through 6.5.4 as in for 489; DIVD’s own CVE JSON cuts before 6.5.4. Treat 6.5.4 as IN until the vendor names it out. DIVD assessed its own tradecraft as agentic AI. That is DIVD’s assessment of DIVD, not a CISA attribution. Confidence that an autonomous agent ran the chain against DIVD: moderate. Confidence that every other Zammad hit is an AI agent: low. Do not write that.

Last week’s NetScaler 88771/88772 remain CONFIRMED exploited, clocks expired 30 September, ransomware-use still Unknown. They are not new rows. They are the unfinished hunt underneath 88779.

CONFIRMED exploited, still not in KEV: CVE-2026-58138 in Orkes / conductor-oss Conductor. Unauthenticated GraalVM RCE. Same status as two weeks ago. Named actor: UNKNOWN.

NOT exploited on the catalog, still: Check Point CVE-2026-85103 and CVE-2026-91843. 85102 and 93616 remain last week’s KEV rows. No field flip this window.

3. Threat actor / campaign activity

The named kit this week is WHIPSHOT / SLAPSHOT, not a named cluster. Mandiant/GTIG described tradecraft and sectors. They did not print UNC- or APT-style IDs on the 29 September blog. Treat Carmakal’s “suspected state-sponsored” line as a LinkedIn statement restated in the press, not as GTIG’s cluster. Broad and opportunistic follow-on of 88771/88772 is what that same statement forecast. GreyNoise’s 24 September 88771 attempt is independent confirmation of attempted 88771, not a join onto WHIPSHOT.

Symantec / Broadcom, 1 October: Longlegs (aka Storm-2603, Warlock operator) hit at least four organizations in the past two months in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. Victims named by class: a water utility, a telecommunications provider, a regional government body, and a university. Initial access is on-prem SharePoint. The historic door is ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771), patched July 2025. Secondary reporting says the arsenal may include 2026 SharePoint CVEs; Symantec’s protection bulletin does not require that reading. Do not write that this week’s victims used CVE-2026-65660 unless Symantec names it. We do not have that sentence.

Post-exploit, as restated from Symantec’s Threat Hunter Team: web shell on SharePoint, discovery, code execution in the application pool, VS Code tunnels, a tool to disable security software (signed K7RKScan.sys, CVE-2025-1055 BYOVD) pushed to at least 40 hosts in about two hours, then Warlock on at least 33 hosts staged in the domain SYSVOL share so ordinary replication delivered it. China-nexus is Symantec’s cluster label (overlaps cited with CL-CRI-1040, CamoFei, ChamelGang). RWP is not independently attributing.

A SharePoint compromise at a water utility is an IT document-plane incident at an industrial-adjacent organization until someone produces process-control evidence. Symantec named a sector. That is not a confirmed OT impact. We do not have it.

DIVD is a victim, not an actor. Volunteer email addresses got out; DIVD told people to verify off-feeling messages at communications@divd.nl. No named operator.

Last week’s UNC6240 PeopleSoft encoded-path campaign, UAT-12197 / UAT-11823 / UAT-11988 on FMC, and Jade Sleet on the IT-services Mac did not publish a material second-wave increment in this window. PaperCut’s GreyNoise 440 did not grow a published census. An eSentire education-sector PaperCut chain restated this week is an August incident, not a new victim count.

4. Vulnerabilities to prioritize

Order is reachability, unfinished first-ISO risk, and post-exploit value — not CVSS, not row count.

1. Citrix NetScaler CVE-2026-88771 / 88772 — clocks expired 30 September, forensic triage still Yes. Hunt WHIPSHOT/SLAPSHOT, SUID /bin/sh, .deb/.sig PHP handlers, HA-sync persistence before or with 14.1-73.37 / 13.1-64.23. A clean Console IoC scan is not proof. DTLS off is 88772 only.
2. Citrix NetScaler CVE-2026-88779 — due 7 October. Inventory samlAction / samlIdPProfile. Floor 14.1-73.41 / 13.1-64.28 (FIPS 14.1-73.41 FIPS; FIPS/NDcPP 13.1-37.282). 73.37 is in if SAML is on. GDL is interim. DoS on the SAML Gateway is an identity outage; reboot-to-retry 88771 is last week’s RCE on unpatched boxes.
3. Fortinet FortiMail CVE-2026-104286 — clock expired 4 October, firmware still upcoming on FG-IR-26-175 this morning. Disable IBE, pull the GUI, or WAF ../ on /ibe. Hunt the published files, archive234, and the two IPs. Do not close from 7.6.7 notes that never print the CVE.
4. Cisco Catalyst SD-WAN Manager CVE-2026-76504 — clock expired 3 October, no workaround, every on-prem Manager. New floors, not May’s. Hunt encoded j_security_check in serviceproxy-access.log. Admin API on the fabric controller is fabric-wide configuration.
5. Zammad CVE-2026-102489 / 102490 — due today. 7.2.0 for the session bug. Hunt as if 490 is live. Copy logs first. 6.5.4 is IN until Zammad says otherwise. Internet-facing helpdesks are the ticket.
6. Apple CVE-2026-86950 — clock expired 2 October. iOS/iPadOS 26.7.1, Sequoia 15.8.1, Tahoe 26.7.1. Targeted-iOS report, UI:R. MDM the lagging 26/15 trains. iOS 27 is out of this CVE.
7. SharePoint CVE-2026-65660 and ToolShell residuals — last week’s recast clock expired 28 September. This week’s Warlock report is why the hunt did not. On-prem only. Rotate ASP.NET machine keys after the 2025 ToolShell patches if that was skipped. Hunt _layouts drops and SYSVOL staging.
8. Check Point CVE-2026-85102 / 93616 — clocks expired 25 September. Take 26 (or listed Jumbo) for 85102; sk1000171 for 93616; Take 28/29 does not close 93616. 85103 and 91843 still not KEV, still same-class.
9. F5 BIG-IP APM CVE-2026-94127, WSO2 CVE-2026-5430, Arista VCO CVE-2026-93952, PeopleSoft CVE-2026-35273 — leftover last-week KEVs. Clocks expired. Hunts did not.
10. Conductor CVE-2026-58138 — still exploited, still no KEV row. 3.30.2 or later. Restrict the workflow API.

5. Identity / cloud / enterprise

NetScaler SAML is the identity incident this week that last week’s RCE ISO does not retire. A Gateway that is a SAML SP or IdP and is still on 73.37 can be knocked over without authentication. A Gateway that already ran WHIPSHOT is an alternate path around every Conditional Access policy that assumes the concentrator is trustworthy. Rotate VPN accounts, AAA stores, certificates on the box, SAML signing material, and anything the appliance used to join AD. HA-sync on during an upgrade is how you replicate the implant to the peer.

SD-WAN Manager is the fabric-identity incident: unauthenticated netadmin API is not “a GUI CVE.” It is a path to templates, certificates, device lists, and routing for every edge that reports to it. Encoded j_security_check is the hunt primitive. May’s peering patch is a different CWE.

FortiMail is the mail-identity incident. Arbitrary file write on the GUI is code execution on the box that journals the enterprise’s mail. IBE-off is a workaround, not an eviction. Rotate admin credentials, archive-account destinations, and any keys stored on the appliance if the published files or archive234 pattern show up.

Zammad is the helpdesk-identity incident: session fixation to the zammad user is ticket content, attachments, and SSO tokens; root on the host is the rest of the box. 7.2 closes the entry DIVD describes. It does not, on Zammad’s own record, close 490.

Warlock on SharePoint is the document-plane identity incident continuing: application-pool code execution, then domain SYSVOL as the distribution point. Machine-key rotation after ToolShell was the 2025 close. SYSVOL ransomware staging is the 2026 reminder that the farm was a domain join, not a website.

WSO2 admin JWTs, Artifactory tokens, GitLab deploy keys, and leftover ISE/SEG/vCenter/FMC tickets remain the non-human-identity remainder. Their clocks expired. The hunt did not.

6. Ransomware / criminal activity

CONFIRMED this window as a campaign report, not as a new KEV ransomware field: Symantec Longlegs / Storm-2603 deploying Warlock via on-prem SharePoint, including a water utility and a telecom as IT victims. Catalog ransomware-use on CVE-2026-65660 remains Unknown. ToolShell’s 2025 rows are not this week’s adds. Do not invent a KEV flip.

CONFIRMED by CISA, unchanged: ransomware-campaign use of vCenter CVE-2026-59310 (Known since 16 September) and TeamCity CVE-2026-63077 (Known since 5 August). Family unnamed on both.

CONFIRMED by CISA catalog field, not by a new encryptor this week: PeopleSoft CVE-2026-35273 ransomware-use Known since June. Mandiant’s 26 September picture remains steal-then-leak.

All six new KEV rows this week: ransomware-use Unknown. WHIPSHOT is not a locker. FortiMail’s archive234 remote dump is exfil tradecraft, not encryption. SD-WAN Manager has no named follow-on family.

PaperCut KEV ransomware-use remains Unknown. No new GreyNoise increment past 440.

Do not convert a water-utility SharePoint farm into confirmed process impact. Symantec named a critical-infrastructure operator. The access described is SharePoint, SYSVOL, and EDR-killer on Windows hosts.

7. Defensive priorities

1. Internet-facing NetScaler ADC/Gateway (88771/88772 hunt and 88779 SAML second ISO), FortiMail GUI (workaround now, image when PSIRT drops upcoming), Catalyst SD-WAN Manager (new floors, not May’s), Zammad (7.2 plus 490 hunt, due today), leftover Check Point Gateway/Spark 85102, Check Point management 93616, F5 APM OAuth AS, SharePoint Server (ToolShell residuals plus last week’s recast), on-prem VCO, WSO2, PeopleSoft PSEMHUB, leftover ISE / SEG / vCenter / FMC / N-central / ScreenConnect / PaperCut / GitLab / Magento / Artifactory / Conductor.
2. Forensic triage is the instruction on all six new rows and on last week’s NetScaler RCEs. Patching without the hunt is how you leave WHIPSHOT in httpd.conf, a FortiMail ld.so.preload, or a vManage admin session.
3. NetScaler: 73.41/64.28 for SAML; 73.37/64.23 was last week’s RCE floor and is still the WHIPSHOT hunt baseline. Console IoC is first-pass. HA-sync off until the peer is clean. CTX694799 if the box was internet-facing in September.
4. FortiMail: IBE-off or GUI-off-WAN today, even though the KEV clock already expired. Open a support case asking which image is the KEV close. Hunt the published hashes and archive accounts. 7.6.7 notes are a candidate floor, not a waiver.
5. SD-WAN Manager: 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1. Snort 67179 is detection, not the patch. Cloud 20.15.605 is already Cisco’s.
6. Zammad: snapshot logs, 7.2.0, inventory 6.5.x as in, hunt root-level follow-on as if 490 is live. Do not wait for a GHSA that does not exist.
7. SharePoint: ToolShell machine keys, August 11 build for 65660, _layouts hunt, SYSVOL for Warlock staging, K7RKScan.sys BYOVD.
8. Apple: MDM 26.7.1 / 15.8.1 / 26.7.1 on the lagging trains. Not a perimeter interrupt.
9. Check Point: do not apply Take 28/29 and call 93616 closed. 85103/91843 still uncatalogued, still same change window as their siblings.

8. What changed from last week

Last week’s [weekly IT](/posts/2026-09-28-weekly-it-perimeter-netscaler-checkpoint-sharepoint/) was two NetScaler RCEs on KEV due 30 September, Check Point 85102 flipping from unexploited to catalog, SharePoint recast from spoofing due 28 September, F5 APM / WSO2 / Arista VCO / WordPress / PeopleSoft UNC6240.

This week those open items closed or moved as follows:

• NetScaler 88771/88772 clocks expired 30 September. The hunt opened: Mandiant named WHIPSHOT/SLAPSHOT, HA-sync persistence, SUID /bin/sh. CISA added a SIGMA resource on 2 October. Ransomware-use still Unknown. No GTIG cluster ID.
• NetScaler gained a third 2026 KEV, CVE-2026-88779, that last week’s 73.37/64.23 floor does not close on SAML SP/IdP boxes. Due 7 October.
• Check Point 85103 is still not KEV. 91843 is still not KEV. 85102/93616 clocks remain expired.
• SharePoint 65660 clock expired 28 September. The material increment is Symantec’s Warlock/Longlegs report, not a new SharePoint CVE.
• WordPress 87902, MikroTik 67279 clocks expired 28 September. No published second-wave increment that changes last week’s hunt.
• Conductor 58138 is still exploited and still has no KEV row.
• PaperCut did not grow a published victim increment past 440.
• Jade Sleet did not publish a named customer follow-on.
• ISE 76460, SEG 76461, vCenter 59310 ransomware-Known, FMC UAT clusters: no material field flips.
• Artifactory 42016/42018 remain expired. No second wave.
• The target class did not move outward. It stayed on the same boxes and demanded a second build: last week the ADC, the VPN, the OAuth VIP; this week the same ADC’s SAML path, the mail gateway with no ISO, and the SD-WAN controller whose spring patch was the wrong CWE.
• Catalog count 1728 → 1734. Six adds in seven days, versus twelve the week before. Fewer rows. Worse unfinished business.

9. What we are watching next

Whether Citrix or Mandiant names a cluster on WHIPSHOT, a victim increment past “dozens,” or a ransomware-use flip on 88771/88772/88779 before Wednesday’s 88779 clock. Whether 88779 is reclassified from DoS. Whether Fortinet drops upcoming on 8.0.2 / 7.6.7 / 7.4.9 and whether the notes CVE table ever prints 104286. Whether Zammad confirms or kills 490, and whether 6.5.4 is named out. Whether Check Point 85103 or 91843 follows 85102/93616 into KEV. Whether Arista publishes 6.1 / 7.0 VCO fixes. Whether Symantec names 2026 SharePoint CVEs on the Warlock victims, or CISA flips 65660 ransomware-use. Whether Conductor 58138 lands in KEV. Whether UNC6240’s encoded-path trick shows up in other PSEMHUB-adjacent WAFs. Whether GreyNoise or PaperCut publish a second-wave increment. Whether GitLab 85706 produces a documented secrets-to-supply-chain case. Chromium’s next in-the-wild after 85046 and 87491. October Patch Tuesday is still a week out; do not pre-rank it.

10. RWP assessment

Confidence: High on the KEV listing set (catalog 2026.10.04, count 1734), on Mandiant/GTIG’s WHIPSHOT/SLAPSHOT description as written, on Citrix’s 88779 DoS classification and second-floor builds, on Fortinet’s live FG-IR-26-175 still marking fixed trains upcoming, on Cisco’s 76504 TAC-found unauthenticated admin API, and on CISA’s six-row add this window. Moderate on unifying NetScaler second-ISO, FortiMail no-ISO, and SD-WAN Manager into a single “unfinished first patch” week — the pattern is operator consequence, not actor. Moderate on Longlegs as Storm-2603 / Warlock for the four-victim wave (Symantec’s cluster; RWP is not independently attributing). Moderate on DIVD’s agentic-AI read of its own Zammad incident. Low on remaining unpatched internet population, on 88779-as-RCE claims, and on any 2026 SharePoint CVE being the Warlock door this month. None claimed on OT process impact.

The week does not require a new SIEM use-case. It requires the boxes that already got last week’s ISO — especially SAML NetScalers — to be hunted and built again, the mail gateway to be taken off WAN until Fortinet ships, and the SD-WAN controller to be treated as a different CVE than the one you patched in May.

This assessment covers 28 September–5 October 2026 and was published 5 October 2026.