Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks

Fortinet has warned that attackers are actively exploiting a critical FortiMail zero-day vulnerability, putting exposed email security systems at risk. Tracked as CVE-2026-104286, the flaw carries a CVSS score of 9.8 and allows attackers without login credentials to write files on affected devices through specially crafted HTTP or HTTPS requests. Fortinet published advisory FG-IR-26-175 on October 1, 2026, and urged customers to apply workarounds immediately. Security fixes for several affected branches were still listed as upcoming releases at disclosure, making prompt action important for organizations running vulnerable systems. FortiMail 0-Day Vulnerability The vulnerability combines two weaknesses: path traversal, tracked as...

Læs hele artiklen hos kilden.