Threat Brief — 2026-10-02 — KEV catalogue turns up the heat

CISA has formally added the two Zammad zero-days—previously chained by an autonomous AI agent to breach a cybersecurity nonprofit—to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. A new Microsoft Exchange Server elevation-of-privilege flaw (CVE-2026-96940) also surfaced today, requiring only authenticated network access. Meanwhile, the Warlock ransomware campaign targeting Iberian organisations has gained sharper detail around its SharePoint-based initial-access vector.

Top items

• CISA adds Zammad session-fixation and follow-on CVEs to Known Exploited Vulnerabilities catalogue. CVE-2026-102489KEV (Zammad session fixation) and CVE-2026-102490KEV have been added to KEV based on evidence of active exploitation. These are the same flaws chained in the AI-agent breach of DIVD first reported on 2026-09-29 by BleepingComputer; the KEV listing is the first formal confirmation of in-the-wild exploitation by CISA. (src: CISA Current Activity)

• Microsoft Exchange Server elevation of privilege — CVE-2026-96940. A weak-authorization flaw allows an authenticated attacker to elevate privileges over a network. No public exploit or KEV listing is indicated in the source, but authenticated EoP on Exchange is a common stepping-stone for domain-wide compromise. Organisations running Exchange Server should treat this as a priority patch. (src: MSRC Security Updates)

• Warlock ransomware campaign detail: SharePoint vulnerabilities are the initial-access vector. The China-linked Warlock group exploited SharePoint vulnerabilities to breach a water utility, a telecom provider, a regional government body, and a university across Spain and Portugal. This adds specific target-type and exploitation-method detail to the story first reported on 2026-10-01 by DarkReading. (src: BleepingComputer)

Themes

SharePoint as initial-access surface. Warlock's exploitation of SharePoint flaws for network entry echoes the broader pattern of collaboration-platform vulnerabilities serving as front doors for ransomware operators. With Exchange EoP also in today's mix, Microsoft on-premises infrastructure remains a focal point for both espionage and financially motivated actors.

From disclosure to KEV in days. The Zammad zero-days were disclosed via an AI-agent breach on 2026-09-29 and are now in CISA's KEV catalogue within three days—underscoring how quickly niche vulnerabilities can move from proof-of-concept to confirmed active exploitation.

===