The New Industrial Attack Surface

CVE-2026-104286 is a critical path-traversal vulnerability in Fortinet FortiMail that can allow an unauthenticated attacker to write arbitrary files through crafted HTTP or HTTPS requests. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 1 October 2026, confirming exploitation in the wild.

Fortinet's PSIRT guidance should be treated as the authoritative source for currently affected releases, remediated builds and interim mitigations.

The significance is not simply that an email appliance can be compromised. FortiMail is highly trusted infrastructure and may hold or reach credentials, certificates, routing information and directory services. In an oil-and-gas environment, that creates a plausible route from the enterprise edge towards privileged administration and engineering systems.

Further actor attribution and post-exploitation details may emerge, but organisations should not wait for them. Internet-reachable vulnerable appliances should already be treated as potentially compromised until evidence supports a clean assessment.

Apply the vendor remediation or mitigation immediately, preserve evidence, investigate exposed systems and rotate relevant trust material where warranted. For actively exploited perimeter systems, patched should not automatically mean closed.

The UK National Cyber Security Centre issued an alert on 28 September covering Citrix NetScaler ADC and Gateway. CVE-2026-88771 allows unauthenticated remote command execution; CVE-2026-88772 can lead to remote code execution or denial of service under affected configurations. Both are confirmed as actively exploited.

The NCSC recommends isolating affected systems, conducting compromise assessment, installing current updates, reintroducing systems only after remediation and continuing threat hunting afterwards.

NetScaler commonly terminates remote access to internal applications, contractors and privileged services. Where those relationships extend to engineering environments, compromise at the gateway can materially reduce the number of steps separating an external attacker from OT.

Expect continued exploitation of unpatched customer-managed appliances and further forensic indicators. Organisations that only upgraded without investigating historic exposure may still carry unresolved risk.

Identify every customer-managed NetScaler instance, validate the fixed build, preserve evidence and assess whether credentials, sessions or downstream systems were exposed during the vulnerable period.

Oracle disclosed CVE-2026-35273 on 10 June 2026 for PeopleSoft Enterprise PeopleTools 8.61 and 8.62. The vulnerability is remotely exploitable without authentication and can result in remote code execution and takeover of PeopleTools.

On 25 September, Mandiant and Google Threat Intelligence Group reported renewed mass exploitation by UNC6240 (ShinyHunters). The actor modified requests to bypass string-based WAF rules, deployed web shells or used fileless command execution, installed MeshCentral agents and used tunnelling tools for internal access. Mandiant states that WAF rules are not a substitute for applying Oracle's patch.

PeopleSoft may hold HR, procurement, supplier and identity data that helps an attacker understand the organisation and impersonate privileged personnel. The broader lesson is that patch age and threat age are different: a months-old flaw remains current if attackers continue to find unpatched systems.

Systems relying on perimeter filtering rather than Oracle's patch remain at risk. Further extortion and credential-theft activity is plausible where internet-facing Environment Management Hub services remain accessible.

Apply Oracle's security update, disable or remove unnecessary PSEMHUB exposure, hunt encoded-path variants and inspect for web shells, unexpected child processes, MeshCentral agents and stolen service credentials.

ABB disclosed CVE-2026-15952 affecting PCM600 through version 2.14. The weakness concerns permissions associated with the PCM600 Scheduler Service and can permit privilege escalation by a local authenticated user under the stated exploit conditions.

ABB also disclosed CVE-2026-15953 affecting project import handling. Public authoritative reporting reviewed for this edition does not identify active exploitation of either vulnerability.

PCM600 is engineering software used with protection and control equipment. That makes the engineering workstation part of the operational trust boundary. The risk is different from the actively exploited internet-facing products above: these are confirmed weaknesses requiring controlled engineering remediation, not evidence of a current intrusion campaign.

The practical exposure will depend on version, workstation privilege, project-file handling and network reachability. Operators should expect the engineering endpoint itself to receive increasing attacker attention as enterprise-to-OT access paths mature.

Inventory PCM600 installations, apply ABB's current hotfixes and workarounds under OT change control, restrict project files to trusted repositories and remove ordinary web/email activity from high-trust engineering workstations wherever practical.