FortiMail and SharePoint Exploits Top a Busy Security Week

A Week of Expired Deadlines and Strategic Shifts

The week of October 5, 2026 brought pressure on two fronts that rarely share a headline: enterprise networks under active attack, and a reshuffling of America's military posture. On the cyber side, defenders faced several vulnerabilities being exploited at the same time, and two federal remediation deadlines had already lapsed. 2 On the national security side, a weekly special operations roundup reported three developments. The Army met its Special Forces recruiting goals for the first time in ten years, Defense Secretary Pete Hegseth announced six new initiatives, and the United States is withdrawing from Iraq. 1

The two stories differ in kind, but together they describe a security environment where much of the urgent work falls on institutions and organizations rather than on battlefields alone.

The Cyber Picture: Patch Windows Have Closed

The most pressing items are in enterprise software. One weekly threat-intelligence summary called the landscape "exceptionally active." It processed 78 intelligence items, including 20 CVEs. Nine were rated Critical and eight High. The count also covered 15 campaigns and 12 data breaches. 2

Four issues stand out:

• FortiMail (CVE-2026-104286): This is an unauthenticated zero-day under active exploitation. A persistence toolkit has been published and command-and-control IP addresses are known. CISA's deadline for federal agencies to fix it was October 4, and that date has passed. 2
• Microsoft SharePoint Server (CVE-2026-65660): The flaw was first classified as a spoofing bug. It is actually a confirmed authenticated remote code execution vulnerability that attackers use to deploy in-memory webshells. Its federal deadline of September 28 has also passed. 2
• Citrix NetScaler SAML appliances: Builds older than 14.1-73.41 or 13.1-64.28 are being exploited. Organizations that already patched for CVE-2026-88771 through CVE-2026-88778 are not protected and need to upgrade again. 2
• Warlock ransomware: A China-linked group is targeting critical infrastructure in Spanish- and Portuguese-speaking regions. It uses SharePoint exploits and abuses legitimate kernel drivers, a technique known as "bring your own vulnerable driver." 2

The same summary also noted documented real-world intrusions carried out by autonomous AI agents. 2 No technical detail was provided on those cases, so they are better read as an emerging signal than as a fully characterized threat.

Why the Details Matter

The SharePoint misclassification is probably the most instructive item of the week. Security teams often triage by vulnerability category, and "spoofing" usually ranks lower than "remote code execution." A flaw labeled too mildly can therefore sit unpatched while attackers use it. Warlock's reliance on SharePoint exploits shows the cost of that delay. Any on-premises SharePoint server should be treated as a priority. 2

The Citrix situation is a related trap. Teams that applied the earlier fixes may believe they are covered when they are not. In practice, verifying exact build numbers matters more than confirming that "the patch" was installed.

The FortiMail case follows a familiar pattern. Email gateways and other edge appliances sit at network boundaries and often lack endpoint monitoring. That makes them attractive entry points, especially when no credentials are needed to attack them.

The Defense Picture: Personnel and Posture

The special operations roundup gave fewer specifics. Its headline items still carry weight. 1 Meeting Special Forces recruiting targets after a decade of shortfalls points to some recovery in a pipeline that is demanding and slow to rebuild. The brief does not say what caused the turnaround.

The brief also does not describe what Hegseth's six initiatives contain, or the timeline and scope of the Iraq withdrawal. 1 Any read on their impact should wait for fuller reporting. What can be said is that a withdrawal from Iraq would mark a notable change in a long-running U.S. presence. Policy moves and recruiting gains in the same week suggest the Pentagon is reshaping both its forces and where they are deployed.

The Takeaway

The two strands point to the same conclusion. Much of the current security burden falls on defenders at home and in the enterprise. Military commitments abroad may be contracting while state-linked cyber operators keep pressing against critical infrastructure.

For IT and security teams, the priorities are concrete:

1. Patch FortiMail now.
2. Treat SharePoint as an RCE emergency rather than a spoofing issue.
3. Re-check NetScaler build numbers even if the earlier patches were applied.

The broader defense developments deserve close attention as more detail emerges. This week, though, the deadlines that had already passed belonged to the patch queue.