Sécurité IT 2026-10-01

Niveau Tendu — 72/100 — 2026-10-01

Journée « Tendu » : 10 sujets classés, 2 des 10 premiers signalés comme activement exploités, 2 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Fortinet FortiMail Path Traversal Vulnerability (86/100).

1. Fortinet FortiMail Path Traversal Vulnerability — 86/100 (CVE-2026-104286)
2. Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability — 68/100 (CVE-2026-76504)
3. CVE-2026-102427 — Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - sit… — 31/100 (CVE-2026-102427)
4. CVE-2026-76570 — Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1… — 31/100 (CVE-2026-76570)
5. CVE-2026-100255 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via pass… — 30/100 (CVE-2026-100255)
6. CVE-2026-100273 — In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code… — 30/100 (CVE-2026-100273)
7. CVE-2026-100277 — In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature — 30/100 (CVE-2026-100277)
8. Zammad GmbH Zammad Session Fixation Vulnerability — 29/100 (CVE-2026-102489)
9. CVE-2026-103109 — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media i… — 28/100 (CVE-2026-103109)
10. CVE-2026-86131 — A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allow… — 28/100 (CVE-2026-86131)