A mail gateway reads every inbound attachment so nobody else has to. Cisco says one crafted attachment passing through an affected gateway can give an unauthenticated sender root. Nobody has to open it. That same root access can tidy the logs on the box, so the box is the last place to ask what happened. Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 for CVE-2026-76519, a Critical Secure Email Gateway arbitrary file write bug in the Advanced Malware Pro

Zammad CVE-2026-102489 and CVE-2026-102490 chain a session hijack into root. CISA's deadline is today. Recheck the patch status, then run these four hunts.

FortiMail CVE-2026-104286 lets an unauthenticated attacker write files onto the appliance. Fortinet shipped the fixes on Oct 5. Patch now, then run these four hunts.

Microsoft shipped CVE-2026-65660 in August as a moderate spoofing bug at CVSS 6.5. The record now reads remote code execution at 8.8, and CISA added it to KEV on 25 September with forensic triage required. If your farm deferred the August patch because the advisory said spoofing, here is what to hunt.

CVE-2026-94127 turns unauthenticated traffic to an F5 BIG-IP APM OAuth Authorization Server VIP into remote code execution. CVSS 9.8, exploited, on CISA KEV with a forensic triage requirement. Here is the vendor hunt triad in KQL, Falcon CQL, Splunk and Kibana.