Fortinet has warned customers about a critical flaw in its FortiMail email security product that attackers are already exploiting. The vulnerability, tracked as CVE-2026-104286 and rated 9.8 out of 10 for severity, is a path traversal weakness in the FortiMail management interface. It lets an attacker who has not logged in write arbitrary files to an affected system. Fortinet published its advisory on October 1, 2026, and credited a member of its own product security team with finding the flaw.
The affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9. Security updates are not yet available. Until they are, Fortinet advises disabling the IBE feature from the command line, limiting access to the management interface to trusted networks, and checking systems against the indicators of compromise it has published. CISA has given US federal agencies until October 4 to apply mitigations. Fortinet has not said when the attacks began or how many systems were compromised.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
