// day
Sep 30, 2026
2 new incidents, 0 with updates.
## started
- highclosedpatchedclosed Sep 30, 2026
Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
› Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.
CVE-2026-76504 - criticallivepatchedsince Sep 30, 2026
FortiMail unauthenticated file-write zero-day CVE-2026-104286
› Fortinet FortiMail
Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).
CVE-2026-104286
