Three IT Checks This Week: FortiMail Zero-Day, Zammad Help Desks, and Windows Settings Backup

Two of this week's items are servers that sit at the edge of an office and quietly hold a lot of trust: the email gateway that every message passes through, and the self-hosted help desk that stores staff accounts and customer conversations. Both had exploited flaws added to CISA's Known Exploited Vulnerabilities list between October 1 and 2.

The third item is quieter. Windows 11 version 26H2 started rolling out on September 30, and it turns on a cloud backup setting by default for many business PCs. It is useful, but it is not the backup most people will assume it is.

FortiMail has an exploited flaw and no finished patch yet

What happened

On October 1, Fortinet published advisory FG-IR-26-175 for CVE-2026-104286, a critical (CVSS 9.8) flaw in FortiMail, its email security gateway. Fortinet says an unauthenticated attacker can write arbitrary files on the appliance with crafted HTTP or HTTPS requests, and that the flaw "has been reported to be exploited in the wild." (Fortinet FG-IR-26-175) CISA added it to the KEV catalog the same day.

The awkward part is the fix. For FortiMail 7.4, 7.6, and 8.0, the fixed versions (7.4.9, 7.6.7, and 8.0.2) are listed as "upcoming." Fortinet's table tells 7.2 users to move to the 7.4 branch or later, which leaves them waiting on 7.4.9 as well. Until those builds ship, the workaround is the protection.

Who is affected

Any organization running FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or 7.2.0 through 7.2.9. If your mail filtering is a cloud service, or another vendor's gateway, this one does not apply. If you are not sure what filters your mail, ask whoever manages your MX records.

What to check or fix now

• Confirm the FortiMail version from the dashboard.
• Apply one of Fortinet's workarounds today: turn off IBE (identity-based encryption) under Encryption > IBE, or block internet access to the management interface and allow it only from a trusted internal network.
• If you use IBE for encrypted email to clients, plan for that feature being off, or lock down the management interface instead.
• Look for Fortinet's published indicators: connections from 79.141.169.187 or 45.129.0.192, and an archive account named archive234 pointing at a remote server. Fortinet's log example shows exactly that setup, which would suggest someone tried to copy archived mail off the box. (BleepingComputer, with file hashes)
• Install 7.4.9, 7.6.7, or 8.0.2 as soon as Fortinet releases them.

How to prevent it

An appliance's admin page should never be reachable from the internet. That rule has now come up for firewalls (see our FortiGate brief), VPNs, phone systems, and email gateways, and it keeps paying off. Turn off appliance features nobody uses, because a disabled feature cannot be exploited. If FortiMail has archiving turned on, review the archive accounts once a quarter so a new one stands out.

Self-hosted Zammad help desks: update to 7.2.0, then read the fine print

What happened

On October 2, CISA added two Zammad vulnerabilities to the KEV catalog. CVE-2026-102489 is a session fixation flaw that CISA says can lead to remote code execution as the zammad user. CVE-2026-102490 is a privilege escalation from that user to root. CISA notes the two can be chained. The disclosure came out of a case at the Dutch Institute for Vulnerability Disclosure (DIVD), which reports that the chain was used to break into its own network.

Zammad disputes parts of this. In an October 1 statement, the company said CVE-2026-102489 can only be exploited on Zammad 6.5 and older, that 7.0 and later are not affected, and that it hardened the code anyway in 7.2.0. On CVE-2026-102490, Zammad first said it had not received technical details. Later the same day it said it now had them, was working on it, and that the issue "cannot be exploited remotely on its own. An attacker would already need access to your server." (Zammad community thread)

So the picture is still moving: the remote bug mainly threatens old versions, and the root-level bug has no confirmed fixed version yet.

Who is affected

Organizations that host their own Zammad server, especially versions 6.5 or older, which no longer get security fixes. A community post citing DIVD lists versions 1.5 through 7.1.0-alpha for the privilege escalation, but Zammad has not confirmed the scope. Zammad's statement does not address its hosted service, so if you use Zammad's cloud, check with them rather than assuming either way.

What to check or fix now

• Find your Zammad version. If it is 6.5 or older, treat the server as exposed and upgrade now.
• Upgrade to 7.2.0, the current stable release, which Zammad recommends. (Zammad releases)
• If the help desk is reachable from the internet, put it behind a VPN or an access proxy until Zammad publishes a fix for CVE-2026-102490.
• If an old version was internet-facing, look for signs of compromise: unknown admin accounts, new API tokens, odd processes running as zammad, and changes on the host.
• Watch Zammad's GitHub security advisories for the CVE-2026-102490 fix.

How to prevent it

A help desk holds password reset requests, customer details, and often connections to email and directory accounts. That makes it as sensitive as a mail server, and it deserves the same patch schedule. Self-hosted tools only get fixes for the current release, so "it still works" on an old version is not a reason to leave it. If nobody owns updates for it, a hosted plan may cost less than the risk.

Windows 11 26H2 turns on settings backup. It does not back up your files

What happened

Windows 11 version 26H2 became available on September 30 as a gradual rollout. On October 2, Microsoft posted in the Windows message center that the Windows settings backup policy is now on by default for eligible devices, "only if admins haven't explicitly configured the policy." ( Windows message center) Any setting an admin already chose, on or off, is kept. Restore behavior is unchanged and still has to be turned on by an admin.

The feature was previously called Windows Backup for Organizations. According to Microsoft's documentation, it backs up user settings, preferences, and the list of installed Microsoft Store apps about every eight days. It does not back up documents, desktop files, or line-of-business software. (Microsoft Learn)

Who is affected

Business PCs that are Microsoft Entra joined or Entra hybrid joined, upgraded to 26H2, and have no admin setting for this policy. BleepingComputer reports that devices in EU Digital Markets Act regions and sovereign clouds are excluded. (BleepingComputer) Home PCs and computers joined only to a local domain are not part of this change.

What to check or fix now

• Decide whether you want settings backup. For most offices it is harmless and makes PC replacements a little smoother.
• If you want it, set the policy explicitly in Intune or Group Policy so it does not depend on a default. Then also turn on the restore policy, or the backups will never be offered when a new PC is set up.
• If you do not want it, for example because of a client contract about data location, set the policy to disabled before PCs move to 26H2.
• Tell staff and managers plainly that this is not a file backup. Documents still need OneDrive, a file server backup, or a proper backup product.

How to prevent it

The real risk is a false sense of safety. Someone sees "Windows backup is on" in a report, and nobody checks that files are protected. Keep a short written list of what is actually backed up (mailboxes, OneDrive, SharePoint, file server, line-of-business data), how, and when a restore was last tested. Review new Windows feature releases before they reach every PC, so defaults like this are a choice and not a surprise. Related reading: File History backups and what they miss.

What to do this week

1. Find out what filters your email. If it is FortiMail, turn off IBE or block internet access to its admin page today.
2. Check FortiMail logs for the published IP addresses and for an unexpected archive account.
3. If you host Zammad, upgrade to 7.2.0 and take it off the open internet until the CVE-2026-102490 fix ships.
4. Set the Windows settings backup policy on purpose in Intune or Group Policy, and turn on restore if you keep it.
5. Write down what actually backs up your files and email, and when a restore was last tested.

If you need someone who can handle these checks for you, reach out to us. We would be happy to help.

Sources

• Fortinet PSIRT, FG-IR-26-175
• CISA Known Exploited Vulnerabilities catalog
• BleepingComputer on the FortiMail zero-day
• Zammad community thread with the vendor statement
• Zammad releases (7.2.0, September 23, 2026)
• NVD, CVE-2026-102489
• Microsoft Windows message center (October 2, 2026)
• Microsoft Learn: Windows settings backup and restore
• BleepingComputer on the settings backup default