A help desk technician starts a remote session to fix a laptop, and the tool does its job. Behind that session sits one appliance that holds the access for everything the help desk can reach. Mandiant says root on it gives an attacker access to every credential the appliance stores or brokers, and both Mandiant and BeyondTrust say this actor deleted logs. The box is the last place to ask what happened. BeyondTrust published advisory BT26-05 on 15 October 2026 for CVE-2026-102

A mail gateway reads every inbound attachment so nobody else has to. Cisco says one crafted attachment passing through an affected gateway can give an unauthenticated sender root. Nobody has to open it. That same root access can tidy the logs on the box, so the box is the last place to ask what happened. Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 for CVE-2026-76519, a Critical Secure Email Gateway arbitrary file write bug in the Advanced Malware Pro

Picture someone in finance opening a file that arrived in a chat message. There is no yellow bar, no "this file came from the internet" prompt and no SmartScreen warning. If something runs next, nothing on the screen tells them, and nothing tells you either. Microsoft released CVE-2026-96951 on 13 October 2026 as a Windows Shell Security Feature Bypass Vulnerability, marked Exploited: Yes and Publicly disclosed: No. CISA added it to the Known Exploited Vulnerabilities catalog

CVE-2026-21589 lets unauthenticated attackers read files from eight Atlassian Data Center products. Patch now, block with the WAF regex, and hunt your access logs for the two-dot pattern.

Rejetto HFS CVE-2026-61500 lets attackers forge an admin cookie from a weak Math.random() signing key, then reach remote code execution. Versions 3.0.0 through 3.2.0 are affected; 3.2.1 fixes it. Four hunts to find the activity in your logs.

Zammad CVE-2026-102489 and CVE-2026-102490 chain a session hijack into root. CISA's deadline is today. Recheck the patch status, then run these four hunts.

FortiMail CVE-2026-104286 lets an unauthenticated attacker write files onto the appliance. Fortinet shipped the fixes on Oct 5. Patch now, then run these four hunts.

CVE-2026-76504 lets an unauthenticated attacker reach the Cisco SD-WAN Manager admin API with a single encoded request. Here is how the bypass works, how to mitigate it, and four hunts (Splunk, Kibana, Falcon, KQL) to find encoded logins in your logs.

CVE-2026-73570 turns a crafted SMTP message into command execution on a Zimbra mail server, through the optional zimbra-snmp notification path. CVSS 8.9, on CISA KEV, and Shadowserver counts 270-plus compromised instances. The fix landed three weeks before disclosure, so start your lookback at the patch date.

A WAF denial is not proof the request failed. See how attackers used /%50SEMHUB/ to exploit CVE-2026-35273—and run four practical hunts.