KEV-Confirmed Exploitation Spans Zammad, Fortinet, Cisco, and Apple

Session hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legitimate user's active session and escalate to remote code execution running with the privileges of the 'zammad' service account. Exploitation requires passive user interaction (CVSS UI:P) - a logged-in agent or admin must load attacker-influenced content - but no prior credentials or privileges (PR:N), so the practical barrier is the narrow vulnerable version window rather than authentication. The same defect exists in Zammad 7.0.0-7.1.3 but is not exploitable there due to environmental conditions; the reporter's CVSS v4.0 base of 9.4 carries an E:A (Attacked) exploit-maturity metric, though no CISA KEV entry or confirmed public exploit code appears in the supplied data, so no public exploit is confirmed at time of analysis.

Local privilege escalation in Zammad lets an attacker who already controls the unprivileged 'zammad' service account elevate to root on the host, affecting every release from 1.5.0 up to but not including 7.1.0-alpha (including the then-current alpha). The vendor labels this critical with a CVSS 4.0 score of 9.4 and a network/unauthenticated-looking vector (AV:N/PR:N, E:A), but the description confines the attacker to an already-present local/service-account context; our independent assessment therefore re-scores it as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. a high-impact but post-foothold escalation rather than a pre-auth remote compromise. No public exploit code has been identified at time of analysis, and CVE-2026-102490 does not appear in CISA KEV, so the vendor vector's E:A exploit-maturity metric cannot be corroborated here.

Unauthenticated path traversal in Fortinet FortiMail (7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6 and 8.0.0-8.0.1) lets a remote attacker write arbitrary files on the underlying system via crafted HTTP or HTTPS requests, yielding CVSS 9.8 with full confidentiality, integrity and availability impact. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, so it is confirmed actively exploited (CISA KEV), and publicly available exploit code exists, making unpatched internet-reachable gateways an urgent remediation priority. Exploitation requires only that the FortiMail HTTP/HTTPS interface be network-reachable - no authentication (PR:N) and no user interaction (UI:N) - so environments that confine management/web access to trusted networks or a VPN substantially reduce exposure.

Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.

A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway appliances running versions prior to the fixed builds (14.1-73.41, 13.1-64.28, 13.1-37.282, and 14.1-73.41 FIPS for ADC; 14.1-73.41 and 13.1-64.28 for Gateway). The vulnerability is network-reachable with low attack complexity and requires no user interaction, making internet-facing Gateway deployments the primary risk surface. No public exploit code or CISA KEV entry was identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high severity for the availability-only impact.

An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.

OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.