(TLP CLEAR) Weekly Vulnerabilities to Prioritize – October 8, 2026

The below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical vulnerabilities that affect widely used products and may be under active exploitation. WaterISAC draws additional awareness in alerts and advisories when vulnerabilities are confirmed to be impacting, or have a high likelihood of impacting, water and wastewater utilities. Members are encouraged to regularly review these vulnerabilities, many of which are often included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

Citrix NetScaler ADC/Gateway Vulnerabilities
See waterISAC’s notification regarding these vulnerabilities

Citrix NetScaler SAML Zero-Day Vulnerability
See waterISAC’s notification regarding these vulnerabilities

Cisco Catalyst SD-WAN Manager Unauthenticated Bypass Vulnerability
See waterISAC’s notification regarding these vulnerabilities

Atlassian Unauthenticated File Access Vulnerability
CVSS v4.0: 9.3
CVEs: CVE-2026-21589
Description: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions.
Source: https://jira.atlassian.com/browse/BAM-26567

Fortinet FortiMail Vulnerability
CVSS v3.1: 9.8
CVEs: CVE-2026-104286
Description: An improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-175

Oracle PeopleSoft Vulnerability
CVSS v3.1: 9.8
CVEs: CVE-2026-35273
Description: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Source: https://www.oracle.com/security-alerts/alert-cve-2026-35273.html