Security1 hOctober 20, 2026, 17:52

FortiMail and F5 zero-days under active attack: October 2026 patch list

A critical FortiMail zero-day is being exploited for unauthenticated arbitrary file writes, with CISA ordering federal agencies to patch by October 4, 2026. F5 BIG-IP CVE-2026-94127 (CVSS 9.8) allows OAuth token forgery, while Check Point, Cisco and Citrix flaws are also under attack.

DEV Community

Open source

FortiMail and F5 zero-days under active attack: October 2026 patch list

FortiMail: CISA patch deadline is October 4, 2026
F5 BIG-IP CVE-2026-94127 rated 9.8, enables token forgery
Check Point, Cisco SD-WAN and Citrix NetScaler also exploited
Indicators of compromise include IPs 79.141.169.187 and 45.129.0.192

#Fortinet#F5#Cisco#Citrix

FortiMail zero-day CVE-2026-104286 is already exploited

Security

Fortinet confirms FortiMail zero-day: patching does not remove the backdoor

Security

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Security

FortiMail and F5 zero-days under active attack: October 2026 patch list

FortiMail zero-day CVE-2026-104286 is already exploited

Fortinet confirms FortiMail zero-day: patching does not remove the backdoor

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

ZoomEye Finds 3,911 Exposed FortiMail Instances Amid Active Exploitation