grc-scanSecurity & governance
← Back to homethe latest briefing →
Patch tracker5 October 2026Archived edition

What to patch now

This edition was published on 5 October 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest briefing for the current picture.

The takeaway

This week's fixes mostly hit business hardware and software that runs with no login required — your email gateway, your network gear, and even personal Apple devices in staff hands.

  • Update every iPhone, iPad and Mac in the business today — the Apple fix applies broadly.
  • Running FortiMail or a self-hosted Zammad helpdesk? Patch now — both let an outsider in with no login.
  • Rely on a network or connectivity provider for SD-WAN or Citrix NetScaler? Ask them to confirm patches are applied.

What to patch now — 5 October 2026

Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.

1. Apple iOS, macOS and iPadOS — a flaw in the image-handling code can let an attacker run their own code on the device (CVE-2026-86950)

🛠️ Apple iPhone, iPad and Mac (iOS, iPadOS, macOS) · added 29 Sep 2026 · CISA fix-by date 2 Oct 2026 (3 days overdue)

What it is: "Out-of-bounds write" means a part of Apple's software that draws images and graphics (CoreGraphics) can be made to write data past the boundary of the memory it was given — and a carefully crafted file, such as a malicious image, can turn that mistake into a way to run an attacker's own code on the device.

Who's affected: Any business whose staff use an iPhone, iPad or Mac — which in practice is most small businesses, since even a company that doesn't think of itself as "an Apple shop" usually has at least one owner or employee relying on an iPhone for calls, email or banking apps.

What to do: Update every iPhone, iPad and Mac in the business today — on iPhone/iPad: Settings → General → Software Update; on a Mac: System Settings → General → Software Update. The fix spans Apple's whole device line, so don't assume a device updated last month is still covered.

2. Cisco Catalyst SD-WAN Manager — a request-encoding bug lets an outsider log in as an administrator with no password (CVE-2026-76504)

🛠️ Cisco Catalyst SD-WAN Manager · added 30 Sep 2026 · CISA fix-by date 3 Oct 2026 (2 days overdue)

What it is: "Improper handling of URI encoding" means the login-checking code can be fooled by a web address written in an unusual encoding ("hex encoding") that it fails to recognise as the same request a human would type — letting it slip past the check and reach the system with full administrator rights, with no account needed at all.

Who's affected: Not something a small business runs itself — SD-WAN Manager is the central console an internet or managed-network provider uses to control a business's wide-area network, for example linking branch offices together. If your connectivity provider delivers your network using Cisco Catalyst SD-WAN, a breach there is their problem to fix, but it can still disrupt your connection.

What to do: Ask your network or connectivity provider whether they run Cisco Catalyst SD-WAN Manager, and if so, whether Cisco's fix (advisory cisco-sa-sdwan-webauth-xr8beuuU) has been applied.

3. Fortinet FortiMail — a path-traversal flaw lets an outsider plant files on the appliance with no login (CVE-2026-104286)

🛠️ Fortinet FortiMail · added 1 Oct 2026 · CISA fix-by date 4 Oct 2026 (1 day overdue)

What it is: "Path traversal" means software that's only supposed to write files inside its own designated folder can be tricked — using special characters in a request — into writing a file somewhere else on the system instead. A related flaw in how the software handles certain characters means an attacker needs no account to pull this off, and a planted file can become a foothold for further compromise.

Who's affected: Businesses using FortiMail, Fortinet's email security gateway, to filter spam and malicious email before it reaches staff inboxes — a common choice for small and mid-sized businesses that want dedicated email filtering without building it themselves.

What to do: Apply Fortinet's fix referenced in advisory FG-IR-26-175 now — the CISA deadline has passed. If an IT provider manages your email security, ask them today whether your FortiMail appliance is patched.

4. Zammad helpdesk software — two flaws that chain into full control of the server (CVE-2026-102489, CVE-2026-102490)

🛠️ Zammad · added 2 Oct 2026 · CISA fix-by date 5 Oct 2026 (due today)

What it is: Two bugs that work together. The first ("session fixation") lets an attacker pre-set a victim's login session so that, once the victim logs in, the attacker can effectively step into it — and here that step can be escalated into running code as the service's own account. The second lets that same account climb further, all the way up to full administrator ("root") control of the underlying server. Chained, the two give an attacker a path from the outside straight to complete control of the machine.

Who's affected: Businesses running Zammad, an open-source customer-support ticketing system, to manage support tickets and customer communication — typically self-hosted rather than used as someone else's cloud service, which is what makes the server-takeover risk real here.

What to do: Update Zammad to the latest patched release today (zammad.com/en/product/releases) — if a developer or IT provider set up and maintains your Zammad instance, ask them to confirm it's done.

5. Citrix NetScaler — a memory-handling bug can crash the device (CVE-2026-88779)

🛠️ Citrix NetScaler ADC and NetScaler Gateway · added 4 Oct 2026 · CISA fix-by date 7 Oct 2026

What it is: A second NetScaler flaw added to the catalog inside two weeks (see the previous edition for the pair of bugs reported in September). This one is a memory-handling bug: an attacker sends the device data it isn't prepared to safely process, crashing it and knocking out whatever it was doing — for NetScaler, usually staff remote access or traffic management for internal apps.

Who's affected: Businesses using Citrix NetScaler as a remote-access gateway (staff VPN) or to manage traffic to internal applications — the same population flagged in the last edition.

What to do: Apply Citrix's fix (support article CTX697174) as soon as possible. If NetScaler was already patched after last week's briefing, check with your IT provider that this additional, separate bug is covered too.

This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from CISA's public Known Exploited Vulnerabilities catalog. This briefing is for awareness purposes only and does not constitute professional security advice; always confirm affected versions and the fix against the vendor's own advisory.