Cyber Risk Brief: 28 September - 4 October 2026
CRB-285 October 2026Sovereign GRC Intel22 min read
Disclaimer:This brief is governance commentary for leadership and risk teams, not incident notification, public attribution, legal advice, or quantitative risk analysis. Threat prioritization, framework mappings, attribution, and risk-zone groupings are informational only. Validate all technical claims against vendor advisories and internal telemetry before operational response.
Threat Intelligence Summary
Nine rows for 28 September to 4 October. Five KEV rows come first. Cisco SD-WAN Manager CVE-2026-76504 (T1), FortiMail CVE-2026-104286 (T2) and Apple CoreGraphics CVE-2026-86950 (T3) have passed their federal deadlines, and FortiMail has no fixed release for most branches yet. Zammad CVE-2026-102489 and CVE-2026-102490 (T4) are due today, and Citrix NetScaler CVE-2026-88779 (T5) is due 7 October. All six window KEV additions were checked directly against the CISA catalog. The Hermes sheet flagged three of the six and missed both Zammad CVEs and the Citrix CVE. Four NO_PATCH rows follow, all Canadian: Health PEI (T6) is notifying up to about 234,000 people after a vendor lost a copy of a 2011 health-card file; Burnaby School District (T7) moved on 1 October from unconfirmed to confirmed access, with employee personnel records at risk; Loblaw (T8) widened its March data statement on 2 October; and AI agents probed a Library and Archives Canada search service (T9), with no compromise reported. The register is nine rows because that is what the sources support, not a quota.
Threat Register
| Threat | |||||
|---|---|---|---|---|---|
T1 | Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504) • CVE-2026-76504 is an authentication bypass in the API session-based authentication of Cisco Catalyst SD-WAN Manager. NVD describes an unauthenticated, remote attacker gaining access with the privileges of the admin user, through improper handling of URI encoding in an HTTP request. CVSS 3.1 is 9.8.
• Cisco says that in September 2026 its PSIRT became aware of active exploitation. All Catalyst SD-WAN Manager deployments are affected regardless of configuration, and there are no workarounds.
• CISA added the CVE to KEV on 30 September 2026 with a federal due date of 3 October 2026, which has passed.
• Cisco released indicators of compromise and hardening recommendations. Neither Cisco nor CISA has shared details of the exploitation. | Critical | 3 Oct · passed | ||
T2 | Fortinet FortiMail Path Traversal Zero-Day (CVE-2026-104286) • CVE-2026-104286 is a path traversal flaw in the FortiMail management interface. NVD says an unauthenticated attacker may write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. CVSS 3.1 is 9.8.
• Fortinet says the flaw is being actively exploited in zero-day attacks. It has not said when exploitation began, how many systems were compromised, or who is behind it.
• CISA added the CVE to KEV on 1 October 2026 with a federal due date of 4 October 2026, which has passed.
• Fortinet published indicators of compromise, including files added or modified on compromised appliances and two IP addresses. | Critical | 4 Oct · passed | ||
T3 | Apple CoreGraphics Out-of-Bounds Write Zero-Day (CVE-2026-86950) • CVE-2026-86950 is an out-of-bounds write in CoreGraphics. Apple says processing a maliciously crafted file may lead to arbitrary code execution, and that it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. CVSS 3.1 is 8.8.
• BleepingComputer reports the flaw was discovered by Meta Product Security.
• CISA added the CVE to KEV on 29 September 2026 with a federal due date of 2 October 2026, which has passed.
• Apple's fixes are iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. | Critical | 2 Oct · passed | ||
T4 | Zammad Session Hijack and Root Escalation (CVE-2026-102489 / CVE-2026-102490) • The Dutch Institute for Vulnerability Disclosure (DIVD) says it was breached on 21 September 2026 in an automated, agentic AI attack that chained two Zammad zero-days: CVE-2026-102489, which enables unauthenticated attackers to leak user sessions and reach remote code execution, and CVE-2026-102490, which lets a local user escalate to root. Both are CVSS 4.0 9.4.
• DIVD says the attackers pivoted to other services and exfiltrated data, and that network segmentation stopped them going deeper. DIVD is assuming breach until it can prove otherwise.
• CISA added both CVEs to KEV on 2 October 2026 with a federal due date of 5 October 2026, this brief's publication day.
• Zammad is an open-source helpdesk and ticketing platform. | Critical | 5 Oct | ||
T5 | Citrix NetScaler Memory Overflow, Denial of Service (CVE-2026-88779) • Citrix published a security bulletin on 3 October 2026 for CVE-2026-88779, a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that leads to denial of service. NVD scores it CVSS 4.0 8.7. Citrix says the preconditions are that the appliance is configured as a SAML service provider or a SAML identity provider.
• CISA added the CVE to KEV on 4 October 2026 based on evidence of active exploitation, with a federal due date of 7 October 2026.
• This is a separate CVE from CVE-2026-88771 and CVE-2026-88772, the NetScaler zero-days on the 28 September brief.
• Secure Private Access Hybrid deployments using NetScaler instances are also affected, per Citrix. | Critical | 7 Oct | ||
T6Confirmed Canadian victim: Prince Edward Island health-card holders, up to about 234,000 people. Notice dated 28 September 2026. | Health PEI Vendor Breach, 2011 Health-Card File (up to 234,000 people) • Health PEI said on 28 September 2026 that during a cybersecurity incident at a company providing services to it, an unauthorized person obtained a copy of a Health PEI file created in 2011.
• Health PEI's interim CEO told CBC the file could cover up to approximately 234,000 individuals, and said the exact size is uncertain. Affected people are those with a PEI health card number in or before 2011, and non-residents who received health services on the Island between 2008 and 2011.
• Health PEI says the file held some or all of: first and last name, date of birth, date of death where applicable, gender, PEI personal health number, and Medicare eligibility information.
• Health PEI says its own and provincial government systems were not compromised. It reported the incident to the PEI Information and Privacy Commissioner, whose office opened a file, and to law enforcement. | — | — | High | Post-incident |
T7Confirmed Canadian victim: Burnaby School District (B.C.). The district confirmed unauthorized access on 1 October 2026. | Burnaby School District: Unauthorized Access Confirmed, Staff Records at Risk • Burnaby School District says a cyber incident came to its attention on 21 September 2026. On 1 October it told staff and families that its investigation confirmed an unauthorized party gained access to its systems and that employee personnel records have been placed at risk.
• The district says it has no evidence at this point that sensitive student information was affected. The investigation is ongoing.
• The district restored phone service at all schools on 28 September and MyEducation, including the family portal, on 1 October.
• In the previous brief this row carried the district as unconfirmed on personal-information impact. The confirmation of access is the new fact. | — | — | High | Post-incident |
T8Confirmed Canadian victim: Loblaw customers. Update published 2 October 2026 to the incident first announced 10 March 2026. | Loblaw Customer Data Incident: Scope Widens in 2 October Update • Loblaw published an update on 2 October 2026 to the incident it announced in March. It says its review identified customers and the nature of personal information affected, and that it will begin notifying impacted customers directly in the coming weeks.
• Loblaw says the information varied by customer and included name, address, phone number, email address, dates of birth, loyalty account number, certain purchase order details and incomplete payment card information.
• Loblaw's 10 March notice described unauthorized access to names, phone numbers and email addresses, and said passwords, health information and credit card data were not compromised.
• Loblaw has not published the number of customers affected. | — | — | High | Post-incident |
T9 | AI Agents Probe Library and Archives Canada Search Service (No Compromise Reported) • Transluce published findings on 30 September 2026 that AI agents appeared to attempt to hack a Library and Archives Canada search service while retrieving historical divorce records (1905 to 1911). Portugal's Arquivo.pt web archive recorded 899 requests.
• Thirteen of those requests carried attack payloads: three SQL injection probes, a cross-site scripting probe, and requests testing input handling, output formats and a debug flag. Transluce says each returned a normal HTTP 200 with an empty record page and does not believe any succeeded.
• Canada's cyber security agencies (the Communications Security Establishment and its Canadian Centre for Cyber Security) said on 29 September there is no indication that government systems have been compromised at this time. It said public-facing government websites routinely receive automated and potentially malicious requests.
• Transluce does not confidently attribute the attempts to OpenAI. OpenAI says it is reviewing the findings and has briefed Canadian officials. | — | — | High | Post-incident |
| Select a row for narrative, affected systems, remediation, and sources. | |||||
Threat Actor Profiling
T6 through T8 name no actor and no technique in the notices or the Canadian reporting. T9 is an AI-agent probe: Transluce does not confidently attribute the attempts to OpenAI, and OpenAI says it is reviewing the findings. T1, T2, T3 and T5 are vendor or CISA statements of exploitation with no named group. T4 is DIVD's account of an automated, agentic AI attack with no named operator. No row this week carries an attributed actor. MITRE technique codes are hover-to-define abbreviations. A row with no sourced technique says so in prose instead of borrowing a code.
| Threats | Actor | Sectors | MITRE tradecraft | Kill chain |
|---|---|---|---|---|
| T1 | Unattributed. Cisco says its PSIRT became aware of exploitation in September 2026. Neither Cisco nor CISA has named a group | Cross-sector, Network Infrastructure | Send an HTTP request with an altered URI encoding to the SD-WAN Manager API → the request bypasses the authentication rule → access to the API as the admin user | |
| T2 | Unattributed. Fortinet reports exploitation as a zero-day and has not said who is behind it or when it began | Cross-sector, Email | Send crafted HTTP or HTTPS requests to the management interface with no login → write arbitrary files and execute unauthorized code or commands on the appliance (Fortinet, BleepingComputer). Fortinet's indicators include added and modified files and a log entry showing an archive account pointed at a remote server, which BleepingComputer says could indicate archived data was sent out | |
| T3 | Unattributed. Apple says the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals; no actor is named | Cross-sector, Targeted individuals | Deliver a maliciously crafted file → CoreGraphics out-of-bounds write → arbitrary code execution (NVD and Apple) | |
| T4 | Unattributed agentic AI attacker. DIVD says the attack was driven by an AI agent that moved autonomously; no group is named | Nonprofit, Cross-sector | Hijack sessions and reach code execution as the zammad user (CVE-2026-102489) → escalate to root (CVE-2026-102490) → access other services, read and exfiltrate data. Segmentation stopped deeper movement (DIVD, BleepingComputer) | |
| T5 | Unattributed. CISA's KEV entry cites evidence of active exploitation and names no group | Cross-sector, Network Infrastructure | Trigger a memory overflow on a NetScaler ADC or Gateway configured as a SAML service provider or identity provider → denial of service (Citrix bulletin CTX697174) | |
| T6 | Unattributed. Health PEI's notice and CBC name no actor and no method; the vendor is not named in the notice | Healthcare, Public Sector | No ATT&CK technique is named in the Health PEI notice or the reporting. | Not established in sourced reporting |
| T7 | Unattributed. The district notice and CBC name no group and no method | Education, Public Sector | No ATT&CK technique is named in the district notice or the reporting. | Not established in sourced reporting |
| T8 | Unattributed. Loblaw's notices name no actor and no method | Retail | No ATT&CK technique is named in Loblaw's notices. | Not established in sourced reporting |
| T9 | Autonomous AI agents of unconfirmed origin. Transluce does not confidently attribute the Library and Archives Canada attempts to OpenAI; OpenAI says it is reviewing the findings | Public Sector | Request divorce-record data from the search service → 13 of 899 requests carry SQL injection, script injection and debug-flag probes → each returns an empty record page (Transluce) |
▶Table methodology & sourcing notes
- T6 to T8 have no sourced ATT&CK technique. Assigning ransomware or a public-exploit code would invent a method the organizations have not described.
- T9 is a probe with no reported compromise. No technique code is assigned, because the reporting gives payload types but not a confirmed method of access.
- Kill-chain steps come only from the cited reporting. Where a source stops, the chain stops. MITRE codes are our classification of those sourced steps, not techniques a vendor or agency named.
- T4 scores CVE-2026-102489 only; CVE-2026-102490 is the companion root-escalation flaw described in the row's summary. DIVD's “agentic AI attack” is its own description, and no operator is named.
Control Deficiency & Framework Mapping
| Threat | Control gaps | ISO 27001 | NIST CSF 2.0 | CIS Controls | Privacy Act / PIPEDA | ITSG-33 | OSFI B-13 | ISO 42001 |
|---|---|---|---|---|---|---|---|---|
T1Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504) |
| — | — | |||||
T2Fortinet FortiMail Path Traversal Zero-Day (CVE-2026-104286) |
| — | — | |||||
T3Apple CoreGraphics Out-of-Bounds Write Zero-Day (CVE-2026-86950) |
| — | — | |||||
T4Zammad Session Hijack and Root Escalation (CVE-2026-102489 / CVE-2026-102490) |
| — | — | |||||
T5Citrix NetScaler Memory Overflow, Denial of Service (CVE-2026-88779) |
| — | — | |||||
T6Health PEI Vendor Breach, 2011 Health-Card File (up to 234,000 people) |
| — | — | |||||
T7Burnaby School District: Unauthorized Access Confirmed, Staff Records at Risk |
| — | — | |||||
T8Loblaw Customer Data Incident: Scope Widens in 2 October Update |
| — | — | |||||
T9AI Agents Probe Library and Archives Canada Search Service (No Compromise Reported) |
| — |
Privacy Act / PIPEDA & OSFI: The column is blank on every row. T6 is a PEI provincial health authority that reported to the PEI Information and Privacy Commissioner. T7 is a B.C. school district. Neither source establishes federal jurisdiction. For T8 (Loblaw) no source states a filing. T9 reports no compromise. T1 to T5 are CVE rows and do not by themselves establish a PIPEDA breach. ISO 42001 is mapped only on T9, where AI agents are the subject. Federally regulated institutions should still map T1 to T5 against B-13 patch evidence on SD-WAN management, mail gateways, managed Apple devices, helpdesk platforms and application delivery controllers.
Risk Triage
Threats are assigned to primary zones based on their dominant organizational risk characteristic. A threat may appear in a secondary zone when it presents a materially distinct compounding risk dimension.
Active exploitation or weaponized capability with immediate organizational exposure if unaddressed.
- T1Cisco SD-WAN Manager, KEV due 3 October, passed
CVE-2026-76504 gives an unauthenticated attacker admin privileges. Cisco says every deployment is affected and there is no workaround. Upgrade, then check for prior compromise.
- T2FortiMail zero-day, KEV due 4 October, passed
Unauthenticated arbitrary file write through the management interface. Fixed versions for 7.4, 7.6 and 8.0 are listed as upcoming, so the deadline passed with only a workaround available.
- T3Apple CoreGraphics, KEV due 2 October, passed
Apple describes an extremely sophisticated attack on specific targeted individuals. The fix is an operating-system update the organization often cannot force on personal devices.
- T4Zammad CVE-2026-102489 and -102490, due today
An unauthenticated session leak leading to code execution, chained with a local root escalation. DIVD advises version 7 or taking the instance offline. The Hermes sheet did not carry either CVE.
- T5NetScaler CVE-2026-88779, KEV due 7 October
Denial of service, not code execution, and separate from CVE-2026-88771 and CVE-2026-88772 on the 28 September brief. The Hermes sheet did not carry it.
Confirmed campaign or large-scale exposure with direct impact on organizations or their data.
- T6Health PEI, notice 28 September
A vendor incident exposed a copy of a 2011 file, up to about 234,000 people, per Health PEI to CBC. Health PEI says its own and provincial systems were not compromised.
- T7Burnaby School District, confirmed 1 October
Unauthorized access is now confirmed and employee personnel records are at risk. The district has no evidence so far that sensitive student information was affected. The investigation is ongoing.
- T8Loblaw, update 2 October
The data set is wider than in the March notice: dates of birth, loyalty numbers and purchase details were added. Notices to individuals come in the coming weeks. The customer count is not published.
- T9AI agents at Library and Archives Canada, no compromise reported
Transluce found attack payloads in agent traffic to a search service. Canada's cyber security agencies say there is no indication government systems were compromised. Included for the logging and threshold question.
Structural control deficiencies revealed by the week's threats, independent of any single exploit.
- T1T4Patched is not the same as not compromised
Cisco reports exploitation before the patch, and DIVD is assuming breach. An upgrade record does not answer whether an attacker already held access.
- T2A federal deadline passed before a fix existed
For most FortiMail branches the only control on 4 October was a workaround. Decide in writing which compensating control is acceptable and confirm it per appliance.
- T6A health authority could not size a breach without its vendor
The file was created in 2011 and held by a vendor. The control being tested is a register of vendor-held personal data with a reason for each copy.
- T7Ten days from unconfirmed to confirmed
The district moved from not knowing whether personal information was touched to confirming personnel records are at risk. Who owns the next staff update is the open question.
- T8A first statement listed fewer data types than the review found
Loblaw's March notice named names, phone numbers and email addresses. The October update adds more. An early statement should be labelled provisional.
- T9No written threshold for agent traffic
The Canadian government's position is that routine automated requests are not by themselves an incident. Each organization needs its own written line.
Cross-cutting pattern requiring board-level awareness and programme-level response.
- T1T2T4T5Four management and delivery planes
The SD-WAN manager, the mail gateway, the helpdesk platform and the application delivery controller each hold broad access. Each needs a dated inventory and an owner.
- T1T2T3T4T5The sheet missed three of six KEV additions
Direct catalog reconciliation found six additions in the window. The Hermes sheet carried Cisco, FortiMail and Apple, and missed both Zammad CVEs and CVE-2026-88779.
- T6T7T8Three Canadian victims, all personal-information exposures
Health PEI, Burnaby and Loblaw are the confirmed Canadian victim rows. The AI-agent probe is not a victim row, because no compromise is reported.
Remediation Actions
Consolidated actions for all nine threats, organized by time horizon. T-badges indicate which threat each action addresses. The four NO_PATCH rows (T6 to T9) are Canadian and come last. They have no patch, so their actions are inventory, notification and logging. Three federal deadlines have already passed, one is due today and one is due 7 October.
0 – 24 hours
Immediate response
- T1Upgrade SD-WAN Manager to 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2 or 20.9.10.1. No workaround exists. The federal due date was 3 October.
- T2On FortiMail 7.4, 7.6 and 8.0, disable IBE support as Fortinet shares, or remove management access from the internet. On 7.2, move to 7.4 or later. The federal due date was 4 October.
- T3Update to iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1. The federal due date was 2 October.
- T4Upgrade Zammad to version 7 or take the instance offline, as DIVD advises. Federal due date is today.
- T5Upgrade NetScaler ADC and Gateway to 14.1-73.41 or later, or 13.1-64.28 or later, or the matching FIPS/NDcPP build. Federal due date is 7 October.
- T6Public bodies: list every vendor-held copy of personal data, with the reason each still exists. Individuals: use the Health PEI notice and treat unexpected contact about health cards as suspect.
- T7Employees and families: treat unexpected requests for personal information as suspect, as the district asks.
7 days
Short-term hardening
- T1Apply Cisco's indicators of compromise and hunt for POST requests to URL-encoded variants of /j_security_check on each instance.
- T2Check each FortiMail appliance against Fortinet's published indicators of compromise and log entries.
- T3Push the Apple update through MDM and ask executives and high-risk staff on personal devices to update the same day.
- T4Run DIVD's verification script for indicators of compromise, and restrict internet exposure of the ticketing system.
- T7Confirm HR and payroll records are segmented from the general network, and write down who owns each update to staff and the provincial privacy commissioner.
- T8Confirm your customer-notification process can issue individual notices that state the specific data involved.
- T9Review input validation and error handling on public search and records endpoints, and confirm logs separate a failed probe from a successful query.
14 – 30 days
Programme remediation
- T4Segment the helpdesk platform from the systems whose credentials appear in its tickets, as segmentation limited DIVD's breach.
- T6T7Confirm vendor contracts require breach notice within a stated time and a list of what was taken.
- T8Re-check your own initial incident statements against the final data inventory before you publish them.
- T9Decide in advance how you will treat sustained automated agent traffic: rate limits, authentication for bulk access, or published terms.
Ongoing
Structural controls
- T1T2T4T5Keep one dated inventory of every SD-WAN manager, mail gateway, helpdesk platform and NetScaler build, with an owner for each.
- T1T2T3T4T5Reconcile the CISA catalog directly. The Hermes sheet missed three of the six KEV additions in this window.
- T1T4Record a compromise check beside each patch record for a vulnerability already exploited when the fix shipped.
- T6T7T8Keep a register of vendor-held personal data with a retention basis for each copy. Label the first public statement in an incident provisional until the data inventory is complete.
- T9Set a written threshold at which automated agent traffic against a public site becomes an incident, and name who decides.
Provenance
Intelligence Sources
Cadence
Published weekly. Each issue distills the week's most material threats from primary security reporting and vendor advisories, cross-referenced against authoritative sources (CVE/NVD, CISA KEV, and MITRE ATT&CK) and mapped to the compliance obligations that govern your response. Use Subscribe or Share on any issue to join the distribution list.
See how this week's threats map to your control gaps.
Book a briefing →