The IT week was the session kill. FortiBleed is locking admins out without a CVE; ReliaQuest named Settra on the GlobalProtect cookie; Ahsay walked back 10.3.4; last week’s NetScaler SAML floor is still in.

5–12 October 2026. Five new KEVs, all Integrity Tech Appendix B, due 11 October. FBI/USSS FortiBleed lockouts. Huntress SYSTEM on AhsayCBS. Citrix 107406 is a third SAML overflow that 14.1-73.41 does not close. FortiMail 8.0.2 / 7.6.7 / 7.4.9 shipped.

RWP Ventures · 2026-10-12 · 22 min read · priority 8.8

Executive summary

FACT: Last week the highest-leverage enterprise problem was the second ISO — NetScaler SAML overflow CVE-2026-88779 that 14.1-73.37 does not close, FortiMail CVE-2026-104286 with firmware still marked upcoming, Catalyst SD-WAN Manager CVE-2026-76504 whose May peering floors are the wrong CWE. This week that class did not vanish. Citrix published a third SAML bulletin. Fortinet dropped upcoming. Those are closes and unfinished hunts on last week’s tickets. They are not this week’s pattern.

This week’s pattern is that the build is not the eviction.

CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.08 released 8 October 20:09 UTC, now holds 1,739 rows. Five of those were added on 8 October. All five are Integrity Tech Appendix B CVEs from 2015–2023. Federal clocks were 11 October. Catalog ransomware-use on every new row is Unknown. Four of five carry forensic triage Yes; BIND CVE-2015-5477 is No.

The material IT developments this window are not those five old OSS rows.

On 6 October the FBI and U.S. Secret Service published joint CSA JCSA-20261006-01. FortiBleed is still running against internet-facing FortiGate firewalls and SSL VPN gateways. There is no new CVE. Operators are locking legitimate administrators out. Downstream ransomware is REPORTED: INC/Lynx and Payload. The close the agencies named is terminate sessions, reset passwords, phishing-resistant MFA, PBKDF2, and management off the internet.

On 9 October 19:55 UTC ReliaQuest Threat Research said it continues to observe CVE-2026-0257 on Palo Alto GlobalProtect and named Settra next to Qilin. That CVE has been on KEV since 29 May, due 1 June, ransomware-use Known. ReliaQuest’s operator sentence is the same class as FortiBleed: upgrade is not enough. Terminate active GlobalProtect sessions.

On 7–10 October Huntress confirmed unauthenticated SYSTEM on internet-facing AhsayCBS (CVE-2026-105133 / CVE-2026-105134), five organizations by 8 October. Ahsay said 10.3.4.0 addressed both on 9 October, then on 10 October that it did not fully address either CVE. The named close is partner-only hotfix 10.3.4.45. Neither CVE is on KEV.

On 8–9 October Citrix published CTX697191 for CVE-2026-107406. CISA revised the 27 September NetScaler alert to include it. ACSC: previous patches for 88771–88779 are insufficient. Last week’s 88779 floor 14.1-73.41 / 13.1-64.28 remains in for SAML IdP. New floor 14.1-73.46 / 13.1-64.29. Citrix and MS-ISAC report no exploitation of this CVE. It is not on KEV.

ASSESSMENT: If the patch queue this week was last week’s 73.41 NetScaler ISO plus leftover FortiMail workarounds, you sequenced a second build and called it done. The session on the FortiGate is still the actor’s. The GlobalProtect cookie minted before the May hotfix still looks like a user. The backup console’s August “fix” was walked back. The SAML Gateway needs a third ISO, and WHIPSHOT still outlives the first two.

The week in one assessment

Four threads, one pattern: the ISO, the KEV row, and the vendor “addressed” statement are not remediation if the session, the hash, or the first build is still live. FortiBleed has no CVE and is locking admins out. GlobalProtect 0257 has been patched since May and ReliaQuest is still watching ransomware groups use the cookie. Ahsay told partners 10.3.4.0 was enough, then published a partner-gated hotfix. NetScaler took a third SAML overflow that last week’s 73.41 floor does not close. The five new KEV rows are Integrity Tech’s old doors — ProFTPD, BIND, Struts, ONLYOFFICE, Strapi — due yesterday, not 2026 appliance RCEs. Attackers keep buying the box that already has a session: the firewall admin the owner can no longer log into, the VPN cookie that looks like remote work, the MSP backup console that holds the restore plane.

1. Most important development

The session, not the CVE.

Do not collapse four facts. They are four tickets.

1. FortiBleed is the lockout, not a firmware 0-day. FBI/USSS JCSA-20261006-01, 6 October: internet-facing FortiGate and SSL VPN, credential reuse, stuffing, spraying, and offline cracking of legacy SHA-256 administrator hashes. CISA’s 18 June alert (updated 22 June) and Fortinet’s June PSIRT blog already named this class — credentials from prior incidents plus brute force against boxes with weak passwords and no MFA. The 6 October CSA is the lockout-and-ransomware update. Victim responses: original accounts disabled or passwords changed (T1531). A current FortiOS build does not remove an admin the actor created, does not restore an admin the actor deleted, and does not rotate a hash that was already cracked. Device count >86,644 / 194 countries is SOCRadar via the agencies, not an FBI census. Treat scale as REPORTED, campaign and lockouts as CONFIRMED, ransomware hand-off as REPORTED (“reporting indicates”). Named nation-state: none. This is not [FortiMail 104286](/posts/2026-10-02-fortimail-cve-2026-104286-kev/).

1. ReliaQuest put Settra on the GlobalProtect cookie. CVE-2026-0257 (CWE-565) is not new. Palo Alto published it 13 May. Rapid7 saw successful cookie logons from 17 May. CISA listed it 29 May, due 1 June, ransomware Known. Arctic Wolf, 20 July, documented June intrusions that went from this CVE to domain-wide Qilin. Huntress’s Settra write-up (retail July, manufacturing September, MeshAgent) left initial access UNKNOWN. ReliaQuest, 9 October, is the Settra join. Treat that join as REPORTED ReliaQuest, not as Huntress retroactively naming those two incidents. ReliaQuest’s close is the same sentence as FortiBleed’s: terminate active GlobalProtect sessions after the build is in. A cookie minted before the hotfix still looks like a user. Panorama and Cloud NGFW are not affected per vendor; secondary product tables that pull Cloud NGFW in are wrong.

1. Ahsay walked back the August build. Huntress: unauthenticated RCE as NT AUTHORITY\SYSTEM from 7 October 23:20:15 UTC, five organizations by 8 October, JSP webshells, XMRig disguised as Microsoft Edge. Chain is CVE-2026-105133 (checkSysPwd improper authentication) plus CVE-2026-105134 (command injection at /rps/api/json/UpdateReceivers.do). NVD, 4 October, still lists 10.3.4 as unaffected. Ahsay’s 9 October clarification said v10.3.4.0 “addressed” both. Huntress’s 8 October 18:00 ET update said 10.3.4 is in. Ahsay’s 10 October alert agrees with Huntress on the product statement: 10.3.4.0 did not fully address either identifier. Named close: 10.3.4.45, partner portal, then reboot. Catalog 2026.10.08 / 1739: both CVEs absent. Huntress has not claimed ransomware, backup deletion, or confirmed exfil in this cluster. SYSTEM on the MSP backup console is still a compromise of the restore plane. Reimage if the IoCs are there; do not kill XMRig and keep the CBS. Named actor: none.

1. 73.41 is not 73.46. CVE-2026-107406 is a new CVE, a new bulletin (CTX697191, created 8 October, last published 9 October), and a new floor. Citrix CNA: CVSS 4.0 9.5, memory overflow leading to RCE or DoS, CWE-119. Precondition is SAML, with a version split: older builds are in as SAML SP or IdP; the 88771/88779 band (14.1-73.37 through 14.1-73.41 inclusive, matching 13.1 / FIPS) is in only as SAML IdP. CISA revised the 27 September NetScaler alert on 9 October to include 107406. ACSC, reviewed 9 October: previous patches are insufficient. Citrix community, 8 October: “not aware of any unmitigated exploits of this vulnerability.” MS-ISAC 2026-110: no reports of 107406 in the wild. Do not read the alert title (“Zero-Day Vulnerabilities Exploited”) as a finding against this CVE. 88771, 88772, and 88779 are the exploited set on that page. 107406 is amplification, not a KEV listing.

There is no confirmed OT or physical-process impact. A FortiGate or GlobalProtect gateway in front of an industrial remote-access path is still an IT perimeter compromise until evidence says otherwise. We do not have it. Hitachi RTU500 and Integrity Tech’s ICS-adjacent victims belong in [this week’s weekly OT](/posts/2026-10-09-weekly-ot-rtu500-openpdc-integrity/), not as process impact imported onto FortiBleed.

2. Active exploitation

CONFIRMED in KEV this window, catalog 2026.10.08:

Five rows is not five 2026 appliance stories. They are Appendix B of AA26-281A. Pulse CVE-2019-11510, GitLab CVE-2021-22205, and Shellshock CVE-2014-6278 were already on the catalog; CISA did not re-add them. Clocks expired yesterday. BIND’s TKEY crash is the one row without forensic triage. Strapi’s note says it can be chained with CVE-2023-22621 for RCE; 22621 is not a new KEV row this week.

CONFIRMED exploited this window, not in KEV:

• AhsayCBS CVE-2026-105133 / CVE-2026-105134. Huntress telemetry, 7–8 October, five organizations. Vendor walk-back 10 October. CISA-ADP SSVC on both NVD records, timestamped 5 October, still exploitation: none — that predates Huntress by two days. Treat Huntress as the exploitation evidence, not the catalog.

CONFIRMED exploited, already in KEV, material increment this window:

• CVE-2026-0257 GlobalProtect. Catalog row since 29 May, ransomware Known. ReliaQuest 9 October is campaign continuation plus a Settra join, not a new listing.
• CVE-2026-88771 / 88772 / 88779 NetScaler. Clocks expired 30 September and 7 October. CISA’s 9 October alert text now also says unpatched boxes may use 88779 to force a reboot and accelerate code previously injected through 88771. That is a relationship note, not a reclassification of 88779 from DoS to standalone RCE. Citrix still classifies 88779 as DoS. WHIPSHOT/SLAPSHOT remain the hunt under 88772. No GTIG cluster ID this week.
• CVE-2026-104286 FortiMail. Clock expired 4 October. FG-IR-26-175, updated 5 October (solution) and 7 October (Cloud clarification): 8.0.2 / 7.6.7 / 7.4.9 are now the named floors, not upcoming. Cloud moved to 7.6.7 GA or 8.0.2 GA on 5 October. On-prem 7.2.0–7.2.9 still must migrate onto 7.4.9 or above. Workaround (IBE off, GUI off WAN, or WAF POST /ibe containing ../) remains the close where the ISO is not in. Hunt artifacts Fortinet published last week are still the hunt.

CONFIRMED exploited, still not in KEV: CVE-2026-58138 in Orkes / conductor-oss Conductor. Unauthenticated GraalVM RCE. Same status as three weeks ago. Named actor: UNKNOWN.

Not claimed exploited, still not KEV, still in the queue: CVE-2026-107406 (Citrix/MS-ISAC: none in the wild), CVE-2026-21589 (Atlassian: no Cloud exploitation; self-hosted UNKNOWN), CVE-2026-102255 SonicWall SMA1000 (vendor: none in the wild at advisory; honeypot attempts ≠ compromise), Check Point CVE-2026-85103 and management CVE-2026-91843.

Apple CVE-2026-86950 remains on the catalog, added 29 September. Live JSON this morning: due 13 October, forensic triage No, ransomware Unknown. Client-side CoreGraphics, targeted iOS. It is a real KEV row. It is not the WAN-side control plane. Due tomorrow.

3. Threat actor / campaign activity

Integrity Tech / AA26-281A. Nine-organization CSA, 8 October: CISA, FBI, NSA, NCSC-UK, ASD’s ACSC, Canada’s Cyber Centre, Japan’s NPA and NCO, NCSC-NZ, Spain’s CNI. Named enabler: China-based Integrity Technology Group. Agencies: it acquires or builds tools, hosts infrastructure, and compromises networks for China-linked actors. TTPs described as consistent with activity publicly tracked as Flax Typhoon, Ethereal Panda, and Red Juliett. The agencies’ own caveat: vendor clusters are not a 1:1 map to U.S. government attribution. Do not flatten those three names into one actor.

Same-day DOJ/FBI seizure of MicroScan (vulnerability scanning; more than 1,300 scripts) and FishHub (spear-phishing follow-on). Persistence named in the CSA is SoftEther as conhost.exe / dllhost.exe. This is the Department’s second public technical disruption of the company after the September 2024 Mirai botnet takedown. The five new KEV rows are the IT patch ticket. The SoftEther hunt is the persistence ticket. They are not the same change window as FortiBleed or Ahsay. No confirmed OT process impact in the CSA; do not import [Hitachi RTU500](/posts/2026-10-07-hitachi-rtu500-cve-2026-8065-eol/) or [openPDC](/posts/2026-10-09-weekly-ot-rtu500-openpdc-integrity/) onto this campaign.

FortiBleed as initial-access broker. FBI/USSS: the operators’ own open directory made the workflow visible — scanning scripts, a GPU cracking cluster running Hashcat under Hashtopolis, honeypot filters, target lists sorted by revenue. After login they create new local admins, sometimes delete or reset the owner’s accounts, enumerate Active Directory, and package working VPN configurations. The agencies describe an IAB, not a single ransomware brand owning the scanner. INC/Lynx and Payload sit downstream as REPORTED. CSA IP table is June–July observation windows with a cloud-reassignment caveat — hunt leads, not a blocklist strategy.

Qilin and Settra on GlobalProtect. Qilin from CVE-2026-0257 is CONFIRMED Arctic Wolf (June incidents, published 20 July). Some encryption-only, some double-extortion. Hostname kali and overlapping source IPs across victims are Arctic Wolf’s, not ReliaQuest’s invention. Settra-on-0257 is REPORTED ReliaQuest. Huntress MeshAgent/BYOVD gdrv.sys cases remain initial-access UNKNOWN. ReliaQuest related tools (Cobalt Strike, BloodHound, SharpHound) are related activity, not every incident. ReliaQuest hunt leads: 216.245.184.150, .47, .110, and 216.245.184.0. ReliaQuest assesses exploitation highly likely to continue over the next three months — that is ReliaQuest’s forecast, not a CISA statement.

Ahsay post-exploit. Huntress cluster is resource hijacking: XMRig as edge.exe, a Task Manager-aware PowerShell hide, fake MicrosoftEdgeUpdateSvc, payloads from Alibaba Cloud object storage. No named ransomware family. No named APT. Five organizations is Huntress’s 8 October count, not a census of internet-facing AhsayCBS.

WHIPSHOT. No new Mandiant/GTIG cluster ID this week. No ransomware-use flip on 88771/88772/88779. Carmakal “suspected state-sponsored” remains REPORTED, not a GTIG attribution.

Warlock / Longlegs. No material increment past last week’s Symantec 1 October bulletin. Water/telecom victims remain IT SharePoint farms. Do not convert that into process impact this week either.

4. Vulnerabilities to prioritize

Order is operator consequence, not CVSS.

1. FortiGate SSL VPN / FortiBleed — no CVE, session kill today. Terminate all admin and VPN sessions. Reset all Fortinet VPN and administrative passwords. Enforce phishing-resistant MFA. Move administrator storage off legacy SHA-256 onto PBKDF2 (PB2 vs SH2). Restrict or remove internet administration. Hunt planted local admins (adminin, fortiAdmin, forticloud-sync, and the rest of the CSA table) and leftover REST API keys. Out-of-band / serial / local console access is the recovery plan if the actor already changed the password. Firmware is not the eviction.

1. GlobalProtect CVE-2026-0257 — session kill after the May/June build. Dedicated certificate for authentication-override cookies, or disable generate/accept cookie. Do not reuse the portal/gateway HTTPS certificate. Terminate all active GlobalProtect sessions after the hotfix. Hunt Cookie authentications, hostname kali, ReliaQuest’s 216.245.184.0/24 leads, and BloodHound/SharpHound from a VPN IP. Prisma Access 10.2 / 11.2 in; Panorama and Cloud NGFW out.

1. AhsayCBS CVE-2026-105133 / 105134 — 10.3.4.45, then assume compromise if the GUI was on the internet after 7 October. Restrict the management interface until the hotfix is in. Partner portal is IdP-gated; there is no public ISO. Hunt cbssvcX64.exe children, JSP under the CBS web root, XMRig-as-Edge, malicious replication receivers. NVD’s “10.3.4 unaffected” is stale relative to the vendor’s 10 October alert.

1. NetScaler CVE-2026-107406 — third ISO, SAML IdP on 73.41 is still in. Floor 14.1-73.46 / 13.1-64.29 / 14.1-73.46 FIPS / 13.1.37.283. Config check remains add authentication samlAction and add authentication samlIdPProfile. Citrix-managed cloud and Adaptive Authentication are Citrix’s problem. Secure Private Access Hybrid that uses customer-managed NetScaler is in. This upgrade does not hunt WHIPSHOT. CTX694799 if the box was internet-facing in September. HA-sync off until the peer is clean.

1. Integrity Tech five — clocks expired 11 October. Internet-facing ProFTPD 1.3.5, BIND 9.x before the 2015 TKEY patches, Struts 2.3.x with DMI, ONLYOFFICE Docs 5.1.5–5.6.2, Strapi through 4.5.5. Forensic triage Yes on four; BIND No. SoftEther-as-conhost/dllhost is the persistence hunt, not a CVE row.

1. FortiMail CVE-2026-104286 — ISO now exists; hunt has not expired. 8.0.2 / 7.6.7 / 7.4.9. Cloud already Fortinet’s. 7.2 migrates to 7.4.9+. Hunt archive234, the two published IPs, added/modified binaries. Workaround until the image is in.

1. Atlassian CVE-2026-21589 — eight self-hosted Data Center products, unauthenticated file access, CVSS 4.0 9.3. Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye. Exact path required; no directory listing. Cloud patched; Atlassian found no Cloud exploitation. Self-hosted exploitation UNKNOWN. Crowd floor is 7.1.7 (CVE record wrongly 7.1.1); Bamboo floor is 10.2.24 (CVE field 10.2.4). Not on KEV. Historical analog CVE-2021-26086 is already on KEV — context only.

1. Leftovers whose clocks already expired and whose hunts are unfinished: NetScaler 88771/88772/88779, SD-WAN Manager 76504, Zammad 102489/102490, Check Point 85102/93616, SharePoint 65660, F5 APM, WSO2, VCO, WordPress 87902, MikroTik 67279, ISE 76460, SEG 76461, vCenter 59310, FMC, N-central, ScreenConnect, PaperCut, GitLab 85706, Magento, Artifactory, Conductor 58138. Apple 86950 due tomorrow.

Splunk CVE-2026-76268 (Patroni unauth OS command, 9.8) and Tenable Identity Exposure CVE-2026-106126 (SYSTEM on PDCe) shipped this week with no claimed exploitation. Real bugs. Not this week’s interrupt. SonicWall SMA1000 CVE-2026-102255 (pre-auth SSRF, 10.0): patch exists; vendor said none in the wild; Previdian honeypot attempts are recon-scale. Exchange CVE-2026-96940 V2 SU: MSRC not exploited.

5. Identity / cloud / enterprise

The identity plane this week is the VPN session, not Entra.

FortiBleed and GlobalProtect 0257 are the same operator failure mode on two vendors: a valid-looking remote-access session that the SOC will not page as “exploit” until BloodHound or the lockout. FortiBleed’s session is a cracked or stuffed admin/VPN password on FortiGate. GlobalProtect’s session is a forged authentication-override cookie. Both close by killing sessions after the control is in, not by pointing at a build number in CMDB.

Atlassian 21589 is the self-hosted collaboration plane: unauthenticated read of a known file under the web root across eight Data Center products. Cloud is Atlassian’s. The version-field mismatches (Crowd 7.1.1 vs 7.1.7, Bamboo 10.2.4 vs 10.2.24) are how a ticket gets closed on the wrong floor.

AhsayCBS is the MSP restore plane. Identity here is checkSysPwd accepting a random token. The console that creates backup users is the console that just ran as SYSTEM.

Integrity Tech’s SoftEther-as-conhost is living-off-the-land VPN inside the estate, not a SaaS IdP issue. Hunt process names, not a Conditional Access policy.

No material Entra / M365 / AD CS increment published this window that changes last week’s hunt. Microsoft’s 9 October early updates (Partner Center, Bookings, Dataverse, Exchange “more likely”) are cloud/on-prem patches, not KEV. Full October Patch Tuesday is tomorrow; do not pre-rank it from early notes.

6. Ransomware / criminal activity

CONFIRMED by CISA catalog field, unchanged: GlobalProtect CVE-2026-0257 ransomware-use Known since 29 May. ReliaQuest’s Qilin continuation is consistent with Arctic Wolf. ReliaQuest’s Settra join is REPORTED. Do not write that Huntress’s two Settra incidents were 0257.

REPORTED by FBI/USSS: FortiBleed chain as initial entry for INC/Lynx and Payload. Not a new KEV ransomware-use field. FortiBleed itself is not a CVE.

NOT claimed: Ahsay Huntress cluster as ransomware. XMRig is resource hijacking. SYSTEM on a backup server is still a ransomware-enabling position; it is not a named family this week.

CONFIRMED by CISA, unchanged: ransomware-campaign use of vCenter CVE-2026-59310 (Known since 16 September) and TeamCity CVE-2026-63077 (Known since 5 August). Family unnamed on both.

All five new KEV rows this week: ransomware-use Unknown. Integrity Tech is a CNE enabler in the CSA, not a locker.

PaperCut KEV ransomware-use remains Unknown. No new GreyNoise increment past 440.

WHIPSHOT is not a locker. FortiMail’s archive234 remote dump is still exfil tradecraft, not encryption.

Do not convert a water-utility FortiGate or SharePoint farm into confirmed process impact. None of this week’s CSAs showed a PLC write.

7. Defensive priorities

1. Internet-facing FortiGate SSL VPN (session kill, password reset, MFA, PBKDF2, GUI/SSH off WAN — not an ISO), GlobalProtect (0257 build and terminate sessions), AhsayCBS (10.3.4.45, restrict GUI, hunt SYSTEM), NetScaler ADC/Gateway (107406 third ISO on SAML IdP and 88771/88772 WHIPSHOT hunt and 88779), leftover FortiMail GUI (now-shipped 8.0.2/7.6.7/7.4.9 plus hunt), Integrity Tech Appendix B plus SoftEther-as-conhost, Atlassian Data Center 21589, leftover Check Point Gateway/Spark 85102, Check Point management 93616, F5 APM, SharePoint, VCO, WSO2, PeopleSoft, ISE / SEG / vCenter / FMC / N-central / ScreenConnect / PaperCut / GitLab / Magento / Artifactory / Conductor / Zammad / SD-WAN Manager.
2. Forensic triage remains the instruction on last week’s 2026 KEV rows and on four of this week’s five Integrity Tech rows. Patching without the hunt is how you leave a FortiGate admin you cannot log in as, a GlobalProtect cookie, WHIPSHOT in httpd.conf, or SoftEther named conhost.exe.
3. FortiBleed: assume the credential set is still being tried against whatever is still reachable. Lockout reports are the evidence that some of those tries are still succeeding. Plan serial/console access before you need it.
4. GlobalProtect: Cookie logons in GlobalProtect logs, often as a local or generic identity, then HIP/getconfig if the tunnel comes up. EDR that only watches “new external RDP” will miss it until BloodHound or the encryptor.
5. Ahsay: 10.3.4.0 is not a waiver. Partner hotfix, reboot, then treat internet-facing CBS as a compromise investigation if it was reachable from 7 October.
6. NetScaler: 73.46/64.29 for SAML; 73.41/64.28 was last week’s 88779 floor and is still in for IdP. Console IoC is first-pass. CTX694799 if internet-facing in September.
7. FortiMail: the ISO exists. The hunt has not been waived. IBE-off remains valid where the image is not in.
8. Integrity Tech: inventory the five OSS products on internet-facing hosts; hunt SoftEther binaries named as Windows trusted processes. Seizure of MicroScan/FishHub is disruption of their scanner, not a patch of your Struts.
9. Apple: MDM 26.7.1 / matching macOS trains before tomorrow’s 86950 clock. Not a perimeter interrupt.
10. Check Point: 85103 and 91843 still uncatalogued, still same change window as their siblings. Do not apply Take 28/29 and call 93616 closed.

8. What changed from last week

Last week’s [weekly IT](/posts/2026-10-05-weekly-it-second-iso-netscaler-fortimail-sdwan/) was NetScaler second-ISO (WHIPSHOT on 88772, 88779 SAML overflow due 7 October that 73.37 does not close), FortiMail 104286 due 4 October with firmware still upcoming, SD-WAN Manager 76504, Zammad 102489/102490 due 5 October, Apple 86950, Symantec Longlegs/Warlock on SharePoint.

This week those open items closed or moved as follows:

• NetScaler 88779 clock expired 7 October. The hunt opened a third floor: CVE-2026-107406, CTX697191, CISA alert revised 9 October, ACSC previous-patches-insufficient. 73.41/64.28 remains in for SAML IdP. 107406 is not KEV. Citrix/MS-ISAC: no exploitation of this CVE. CISA’s 9 October text now ties 88779 reboots to accelerating 88771-injected code on unpatched boxes.
• FortiMail 104286 firmware shipped. FG-IR-26-175 no longer marks 8.0.2 / 7.6.7 / 7.4.9 upcoming. Cloud fixed 5 October. Clock had already expired 4 October. Hunt is unfinished.
• Zammad 102489/102490 clocks expired 5 October. No vendor confirmation of 490 this window. No second-wave increment.
• SD-WAN Manager 76504 clock expired 3 October. No material field flip.
• Check Point 85103 is still not KEV. 91843 is still not KEV. 85102/93616 clocks remain expired.
• Conductor 58138 is still exploited and still has no KEV row.
• PaperCut did not grow a published victim increment past 440.
• Warlock/Longlegs: no new Symantec CVE join this week.
• Apple 86950 remains due 13 October on the live catalog (forensic triage No).
• Catalog count 1734 → 1739. Five adds in seven days, versus six the week before — and unlike last week, none of the new rows is a 2026 appliance. The unfinished business moved off the KEV add list and onto sessions, walk-backs, and a third ISO that is not yet catalogued.
• The target class did not move outward. It stayed on the same boxes and demanded a session kill: last week the ADC’s SAML path and the mail gateway with no ISO; this week the firewall admin session, the GlobalProtect cookie, the backup console whose “fixed” build was not, and the same ADC’s third SAML floor.

9. What we are watching next

Whether CISA lists Ahsay 105133/105134 or NetScaler 107406. Whether Citrix or Mandiant names a cluster on WHIPSHOT, a victim increment, or a ransomware-use flip on 88771/88772/88779. Whether 107406 draws in-the-wild use now that the alert page carries it next to three exploited siblings. Whether FortiBleed lockout reports produce a named IAB cluster or a KEV-adjacent FortiOS CVE. Whether ReliaQuest’s Settra-on-0257 join is corroborated in a long-form IR, and whether Huntress retroactively names initial access on its two Settra cases. Whether Ahsay’s 10.3.4.45 is independently re-tested outside the partner portal, and whether Huntress’s five-org count grows. Whether Integrity Tech SoftEther-as-conhost shows up in enterprise EDR hunts after the MicroScan seizure, or whether the five KEV clocks produce a second-wave listing. Whether Check Point 85103 or 91843 follows 85102/93616 into KEV. Whether Conductor 58138 lands in KEV. Whether Atlassian 21589 self-hosted exploitation moves off UNKNOWN. Whether SonicWall SMA1000 102255 moves from honeypot attempts to confirmed appliance compromise. Whether Splunk 76268 or Tenable 106126 draw exploitation. October Patch Tuesday is tomorrow; rank it from MSRC, not from this page. Chromium’s next in-the-wild after 85046 and 87491.

10. RWP assessment

Confidence: High on the KEV listing set (catalog 2026.10.08, count 1739), on FBI/USSS FortiBleed lockouts as written in JCSA-20261006-01, on Huntress’s Ahsay SYSTEM cluster and Ahsay’s 10 October walk-back to 10.3.4.45, on Citrix’s 107406 floors and “no unmitigated exploits” statement, on CISA’s 9 October NetScaler alert revision, on Fortinet FG-IR-26-175 now naming 8.0.2 / 7.6.7 / 7.4.9, and on CVE-2026-0257 remaining KEV ransomware Known. Moderate on unifying FortiBleed, GlobalProtect session-kill, Ahsay walk-back, and NetScaler third ISO into a single “the build is not the eviction” week — the pattern is operator consequence, not actor. Moderate on ReliaQuest’s Settra-on-0257 join (single X post, not a long-form IR). Moderate on FortiBleed ransomware hand-off to INC/Lynx and Payload (agencies’ “reporting indicates”). Low on remaining unpatched internet population, on 107406-as-exploited claims, on Ahsay victim count past Huntress’s five, and on Integrity Tech vendor-cluster names as a 1:1 map. None claimed on OT process impact.

The week does not require a new SIEM use-case. It requires killing the FortiGate and GlobalProtect sessions that last quarter’s ISO did not evict, applying a partner hotfix to the backup console whose August build was not the close, building SAML NetScalers a third time, and hunting SoftEther that thinks it is conhost.exe.

This assessment covers 5–12 October 2026 and was published 12 October 2026.