Arbitrary File Write and Session Hijacking: The Fortinet and Zammad Cluster

Two entries from early this week expose a shared theme: attackers reaching beyond application logic to write or execute content at the operating system level.

Fortinet's CVE-2026-104286 in FortiMail — deadline October 4, now overdue — combines a path traversal flaw with improper NULL byte neutralization to allow an unauthenticated attacker to write arbitrary files anywhere on the underlying filesystem via crafted HTTP/HTTPS requests. Arbitrary file write at the OS level, pre-authentication, is operationally equivalent to RCE in most deployment configurations: attackers can overwrite cron jobs, web shells, or configuration files without ever authenticating to the mail server itself. Internet-facing FortiMail deployments should be treated as potentially compromised until patched and forensically cleared. Inbound and outbound mail flow logging should be preserved for post-incident analysis, and any FortiMail instances sitting on network DMZs with admin interfaces reachable from untrusted networks should be immediately restricted at the firewall layer.

The Zammad entries — CVE-2026-102489 and CVE-2026-102490, deadline October 5, today — are notable for their explicit chaining relationship. CVE-2026-102489 is a session fixation vulnerability that enables remote code execution as the zammad service user. CVE-2026-102490 then allows that local zammad user to escalate privileges to root. Together, they form a clean two-step full-system compromise chain. Zammad is widely used as an open-source helpdesk and customer support platform, including in government contractor environments where it may receive sensitive case data or integrate with identity providers. Teams running self-hosted Zammad instances must patch immediately. Post-patch, invalidate all active sessions, rotate service account credentials, and audit sudo rules and SUID binaries on the host — CVE-2026-102490 specifically suggests the privilege escalation path is local, so host hardening matters as much as the application patch itself.

Consumer Platform Risk Spreading to Enterprise: Apple CoreGraphics

CVE-2026-86950 affecting Apple iOS, macOS, and iPadOS via an out-of-bounds write in CoreGraphics may appear to sit outside the traditional enterprise perimeter, but this framing is increasingly obsolete. macOS endpoints are standard issue across development, executive, and legal functions in contractor environments; iOS and iPadOS devices access VPNs, email, and MDM-managed enterprise applications daily. The October 2 deadline has passed. Arbitrary code execution via CoreGraphics — a graphics rendering library invoked by virtually every application on the platform — represents a broad, low-friction attack surface exploitable through malicious documents, web content, or image files.

Security operations teams should confirm device compliance via MDM platforms (Jamf, Intune, etc.) and enforce OS version minimums as a prerequisite for network access. Any device that cannot attest to a patched OS version should be quarantined from corporate resources. The BOD 26-04 forensics triage requirement applies to government-managed Apple assets; contractor environments should mirror this posture under their own patch governance programs.

Bottom line for the week: Five of eight patch deadlines are already overdue as of today. Two Citrix NetScaler CVEs enabling unauthenticated RCE have been exploitable without consequence for at least five days. Remediation velocity, not just patch planning, is the operational imperative this week.

Sources: CISA KEV Catalog · Citrix Security Bulletins · Fortinet PSIRT Advisories · Cisco Security Advisories · Apple Security Releases · Zammad Security Releases · CISA BOD 26-04