Exploitation ReportOctober 3, 2026

Executive Summary

Critical zero-day exploitation activity dominates the current threat landscape, with Fortinet's FortiMail vulnerability (CVE-2026-104286) actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog. The China-linked Warlock ransomware group continues weaponizing Microsoft SharePoint flaws—both old and new—to breach critical infrastructure, government, education, water utilities, and telecommunications providers across Portuguese- and Spanish-speaking regions.

Simultaneously, Dell has disclosed maximum-severity flaws in Container Storage Modules (CVE-2026-63688, CVSS 10.0) enabling unauthenticated administrative access and root compromise on Kubernetes nodes, with patches available requiring immediate application.

Active Exploitation Details

−FortiMail Zero-Day Arbitrary File WriteCriticalActive exploitationPatchCVE-2026-104286#

−Dell Container Storage Modules Authentication BypassCriticalPotentialPatchCVE-2026-63688#

−Microsoft SharePoint Vulnerabilities (Warlock Campaign)HighActive exploitationPatch#

−GitLab AI Gateway Remote Command ExecutionCriticalPotentialPatch#

−Frontline Education Third-Party Software VulnerabilityHighObservedInvestigate#

−DTU Identity and Access Management System BreachHighObservedInvestigate#

−SWIFT Banking Middleware Remote Code ExecutionCriticalPotentialPatch#

−Kiteworks and Citrix Zero-Day IncidentsCriticalActive exploitationPatch#

Affected Systems and Products

• Fortinet FortiMail: All versions prior to patched releases; email security appliances and virtual appliances
• Dell Container Storage Modules (CSM): Versions connecting Dell enterprise storage arrays (PowerMax, PowerScale, PowerFlex, Unity XT) to Kubernetes environments
• Microsoft SharePoint: On-premises and cloud versions; specific vulnerable components not disclosed but exploited for initial access
• GitLab AI Gateway: Self-hosted gateway versions prior to 19.2.4, 19.3.2, and 19.4.1; Duo Agent Platform enabled instances
• Frontline Education Platform: Third-party software component (unspecified) integrated with K-12 education management systems
• DTU Identity and Access Management System: Central authentication and authorization infrastructure at Technical University of Denmark
• SWIFT Middleware: Banking and government messaging middleware deployments in financial institutions and government agencies
• Kiteworks Data Protection Platform: On-premises and hosted file sharing and governance solutions
• Citrix Products: Unspecified Citrix solutions targeted in zero-day exploitation campaign

Attack Vectors and Techniques

• SharePoint Exploitation for Initial Access: Warlock leverages SharePoint vulnerabilities as primary entry vector, chaining flaws to bypass authentication and deploy webshells or malicious payloads
• Security Tool Disablement: Post-exploitation technique targeting endpoint detection and response (EDR) and antivirus solutions to operate undetected during ransomware deployment
• Unauthenticated Arbitrary File Write: FortiMail zero-day (CVE-2026-104286) allows remote file system manipulation without credentials, enabling webshell placement and RCE
• gRPC Authorization Bypass: Dell CSM flaw (CVE-2026-63688) exploits missing authentication in storage authorization service to escalate to cluster-admin on Kubernetes
• AI Gateway Command Injection: GitLab vulnerability allows authorized AI platform users to escape container boundaries and execute host commands
• Cloud Service C2 via Legitimate Platforms: Antino backdoor uses Microsoft Outlook and OneDrive APIs for command-and-control, blending with legitimate traffic
• Browser-Based EDR Evasion: Three techniques identified—session token theft, malicious extension abuse, and user manipulation attacks that leave no endpoint artifacts
• Autonomous AI Agent Reconnaissance: AI-driven automated scanning and exploitation attempts against government web applications for data harvesting
• ATM Jackpotting: Physical and logical attacks on automated teller machines by Tren de Aragua gang for cash extraction
• Supply Chain Credential Theft: ShinyHunters extortion group operations targeting third-party services to access victim data for extortion

Threat Actor Activities

• Warlock (China-linked): Active ransomware campaign exploiting SharePoint vulnerabilities across critical infrastructure, government, education, water utilities, and telecommunications in Portuguese- and Spanish-speaking countries; disables security tools before encryption; tracked by Symantec and Carbon Black Threat Hunter Team
• Antino Operator (China-nexus): Espionage campaign deploying previously undocumented Antino backdoor against government and policy organizations in Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, and Myanmar; uses Outlook and OneDrive for C2; tracked by Cisco Talos
• ShinyHunters: Extortion group; suspected member "Rey" detained in Jordan cooperating with FBI to identify other members; known for data theft and extortion via third-party breaches
• Tren de Aragua (TdA): Venezuelan gang conducting ATM jackpotting attacks across United States; eight members sanctioned by U.S. Treasury Department; millions stolen
• KillSec Ransomware: Operation claiming 500 victims worldwide over two years; alleged mastermind identified as 16-year-old; disrupted by multi-national law enforcement collaboration
• MSS-Backed Academic Espionage (China): MI5 reveals 100+ UK-linked academics funded by China's Ministry of State Security through CGTRI for intelligence gathering research
• Unknown Operators: Microsoft X account hijack for crypto pump-and-dump; autonomous AI agents targeting US/Canadian government sites; malicious Linux implants mimicking Asian mail security products