Faizan Akhtar | Cyber Security Researcher & Bug Bounty Hunter

Summary On October 2, 2026, Microsoft broke its normal patch rhythm and shipped an out-of-band security update for Microsoft Exchange Server. The reason: CVE-2026-96940 , an elevation-of-privilege vulnerability that lets an authenticated attacker read other users' mailboxes inside the same organization. Microsoft rated it CVSS 8.8 (High) and — unusually — tagged it "Exploitation More Likely" even though no attacks have been observed yet. When Microsoft releases a fix eleven days before Patch Tuesday for a flaw nobody has publicly disclosed, that is a signal defenders should not ignore. Severity CVE ID: CVE-2026-96940 Title: Microsoft Exchange Server Elevation of Privilege Vulnerability CVSS 3.1: 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Exploitability assessment: Exploitation More Likely Publicly disclosed: No | Exploited in the wild: No (as of the advisory) Weakness: Weak authorization (listed as CWE-1390) The vector tells the story in one lin...

If you are a NetScaler administrator, the last two weeks have felt like a treadmill: on September 27 Citrix shipped emergency fixes for two exploited zero-days (CVE-2026-88771, CVE-2026-88772), on October 3 it shipped another for a SAML zero-day (CVE-2026-88779) — and on October 8, 2026 , it did it again. Bulletin CTX697191 discloses CVE-2026-107406 , a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service on appliances configured for SAML authentication, rated CVSS 4.0 9.5 (Critical) . The cruelest detail: if you patched for the October 3 zero-day and your appliance is a SAML Identity Provider, you are still vulnerable. Here is my analysis of the flaw, the version maze, and the exact builds that end the cycle. Summary CVE-2026-107406 is an improper restriction of operations within the bounds of a memory buffer (CWE-119) — a memory overflow — in the SAML authentication handling of NetScaler ADC and NetScaler Gateway. Whe...

On October 1, 2026, Fortinet published advisory FG-IR-26-175 for a vulnerability already being exploited against real customer appliances: CVE-2026-104286 , a path traversal flaw in FortiMail that lets an unauthenticated attacker write arbitrary files to the appliance's underlying system through crafted HTTP or HTTPS requests. Rated CVSS 9.8 and listed in CISA's Known Exploited Vulnerabilities catalog the same day, this is a zero-day in the truest sense — Fortinet's own Product Security team discovered it while investigating attacks already in progress. FortiMail sits in front of your organization's email flow, which makes this one of the worst places a file-write primitive can land. Here is my full analysis of the bug, the attack chain, and exactly what to do about it. Summary CVE-2026-104286 combines two weaknesses working together: improper limitation of a pathname to a restricted directory (CWE-22, classic path traversal) and improper neutralization of a NULL by...

WordPress site owners have had a rough year with the Super Forms – Drag & Drop Form Builder plugin. In July 2026, researchers disclosed a critical unauthenticated file-upload flaw (CVE-2026-14894) that attackers began exploiting within days — security teams ultimately blocked more than 250,000 exploit attempts against it. Now, on October 8, 2026, a second critical vulnerability has surfaced in the same plugin: CVE-2026-17609 , an unauthenticated arbitrary directory deletion flaw rated CVSS 9.1. An attacker with no account on your site can recursively delete any directory on the server — including the entire WordPress installation. Here is the full analysis. Summary CVE-2026-17609 affects the Super Forms – Drag & Drop Form Builder plugin for WordPress (vendor: Rens Tillmann / WebRehab), a form builder with an estimated 13,000+ active installations. The plugin's submit_form function fails to properly validate attacker-controlled JSON field declarations against the actual ...

IBM Guardium Data Protection is the product enterprises deploy to watch their databases — it monitors traffic, audits access, and enforces the policies that protect the organization's most sensitive data. On October 8, 2026, IBM published a security bulletin revealing that the very component tasked with sniffing database traffic was itself vulnerable to SQL injection , rated CVSS 9.8 and tracked as CVE-2026-80381 . A remote attacker could execute unauthorized SQL statements against the security product guarding the databases. Here is the full technical breakdown of what happened, why the location of this bug makes it especially serious, and exactly how to remediate it. Summary CVE-2026-80381 is a SQL injection vulnerability (CWE-89) in the Sniffer component of IBM Guardium Data Protection. IBM's bulletin states that a remote attacker could execute unauthorized SQL statements due to improper neutralization of input in SQL commands — the textbook definition of SQL injection, sit...