IT Daily Roundup – October 3, 2026
1. FortiMail: Critical Zero-Day (CVSS 9.8) Actively Exploited
Fortinet is warning of a critical vulnerability, CVE-2026-104286 (CVSS 9.8), in FortiMail, its email security gateway. A combination of a path traversal flaw and improper handling of null characters in the management interface lets an unauthenticated attacker write arbitrary files to the system using crafted HTTP/HTTPS requests. The flaw is already being exploited, and CISA has added it to its Known Exploited Vulnerabilities catalog with an October 4 remediation deadline.
Affected versions are 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1. Fortinet has announced fixed versions 7.4.9, 7.6.7, and 8.0.2; until they are released, it recommends disabling the IBE feature and limiting management interface access to trusted networks. Version 7.2 should be upgraded to at least the 7.4 branch.
Why this matters: An email gateway sits right between the internet and your mailboxes – whoever controls it can read, alter, or spoof company communication and move further into the network. If you use FortiMail, check today that its management interface is not reachable from the internet, and schedule the update as soon as it ships. If you don't know whether your email passes through FortiMail, that's a good question for your IT partner.
2. Microsoft: First Autonomous Ransomware Operated Without a Human Attacker
Microsoft published its Digital Defense Report 2026, documenting JADEPUFFER — the first confirmed case of a fully autonomous ransomware attack. An AI-driven system independently identified victims, encrypted data, issued ransom demands, and managed the entire extortion process without human operator involvement. Related threats documented in the report compromised 225 organizations, exfiltrating 20,000 files and 2,000 sets of credentials.
Other alarming figures: phishing grew from 7% to 23% of all recorded intrusions, the window between vulnerability disclosure and active exploitation has shrunk to under 24 hours, yet average enterprise patching time for critical flaws still takes 30–60 days — a gap attackers are systematically exploiting.
Why this matters: Autonomous ransomware changes the game for small and medium-sized businesses. Traditional attacks required a skilled hacker dedicated to each target; AI-driven attacks can probe thousands of companies simultaneously and automatically strike the weakest ones. Protection rests on two pillars: fast patching (target within 24 hours for critical fixes) and phishing-resistant authentication (MFA or passkeys). Without these two measures, you're an easy target even for a fully automated attack.
3. TeamViewer Fixes Five Vulnerabilities, Urges Immediate Update
TeamViewer has released version 15.82, fixing five vulnerabilities in TeamViewer Full Client and Host for Windows, Linux, and macOS. The most severe, CVE-2026-92370, is a remote session access control flaw that can allow unauthorized actions up to code execution. The other four (path traversal, heap buffer overflow, a race condition, and improper path validation) can let a local attacker run code or escalate to the highest privileges (SYSTEM/root). TeamViewer says it is not aware of any exploitation so far, but recommends updating "as soon as possible."
← All postsWhy this matters: In small businesses TeamViewer is often installed on dozens of computers – for remote support, working from home, or access by external vendors – and rarely updated. Remote access tools are a favorite entry point for attackers. Review where TeamViewer runs, update it to 15.82, and uninstall it wherever nobody needs it anymore.