[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGfoS_6XARE1q9gcZvUjX3kQiHZISfvPQZxZMXoX5c5I":3,"$fLEUQ6ekrOfncPyqKknZhnQyvwKQOubvK-viSV1pv-ck":68},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":64,"created_at":65,"updated_at":66,"published_at":67},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Unauthenticated path traversal in FortiMail 7.2 to 8.0 allows arbitrary file write via crafted HTTP requests; Fortinet rates it CVSS 9.8 and CISA added it to KEV the day it was disclosed.","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[10,11,12,13,14,15],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","CISA KEV","Zero-Day","# Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation\n\n*Unauthenticated path traversal in FortiMail 7.2 to 8.0 allows arbitrary file write via crafted HTTP requests; Fortinet rates it CVSS 9.8 and CISA added it to KEV the day it was disclosed.*\n\n**Tags:** `Fortinet` `FortiMail` `CVE-2026-104286` `Path Traversal` `CISA KEV` `Zero-Day`\n\n> Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS (Fortinet, v3.1) | KEV | Fixed in |\n|---|---|---|---|\n| CVE-2026-104286 | 9.8 (Critical) | ✅ added 1 October 2026, due 4 October | 7.4.9, 7.6.7, 8.0.2; 7.2 users must move to 7.4 or later |\n\n## FortiMail zero-day CVE-2026-104286 is under attack\n\nFortinet has disclosed a critical vulnerability in FortiMail, its email security gateway, that is being exploited in the wild. Tracked as CVE-2026-104286, it combines a path traversal flaw (CWE-22) with improper neutralisation of NULL bytes (CWE-158), and \"may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests\". Fortinet lists the impact as execution of unauthorised code or commands.\n\nFortinet published advisory FG-IR-26-175 on 1 October 2026 and rates the flaw 9.8 under CVSS v3.1 (`AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H`). The vulnerability was found internally by Gwendal Guégniaud of Fortinet's Product Security team. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog the same day and gave US federal civilian agencies until 4 October 2026 to address it.\n\nFortinet has not said when or where the attacks were spotted, how many systems were compromised, or who is behind them.\n\n## Affected and fixed versions\n\n| Branch | Affected | Fix |\n|---|---|---|\n| FortiMail 8.0 | 8.0.0 to 8.0.1 | 8.0.2 or later |\n| FortiMail 7.6 | 7.6.0 to 7.6.6 | 7.6.7 or later |\n| FortiMail 7.4 | 7.4.0 to 7.4.8 | 7.4.9 or later |\n| FortiMail 7.2 | 7.2.0 to 7.2.9 | Move to the 7.4 branch or later |\n\nWhen the advisory was first published the fixed builds had not been released. Fortinet updated the solution on 5 October, and Brandefense reports that fixed releases for the 7.4, 7.6 and 8.0 branches are now available. Fortinet says FortiMail Cloud was fixed on 5 October and Cloud customers need take no action. Note that moving from 7.2 to an affected 7.4 build does not fix the flaw; 7.2 users need 7.4.9 or later.\n\n## How the unauthenticated file write works\n\nAccording to Fortinet and Brandefense, the flaw sits in the request handler for Identity-Based Encryption (IBE), FortiMail's feature for sending encrypted email to recipients without pre-installed certificates. A crafted request can use path traversal sequences to escape the intended directory, while a NULL byte truncates the file name before it reaches the filesystem, letting an unauthenticated attacker write a file to an arbitrary path on the appliance. No session or credentials are needed.\n\n## Indicators of compromise\n\nFortinet's advisory lists two IP addresses, 79.141.169.187 and 45.129.0.192, and log entries to look for, including:\n\n- a cron entry running `\u002Fbin\u002Fsh -c 'O=\u002Fmigadmin ...` as root;\n- a CLI configuration event adding an archive account named `archive234` that sends data to 79.141.169.187;\n- an IBE decrypter `BufferException(2)` for \"Invalid Base64 Encoding\" in the encryption logs.\n\nBrandefense lists file-level indicators: a replaced logging library at `\u002Fdata\u002Flib\u002Fliblog.so`, a modified `\u002Fbin\u002Fsmit`, a replaced `\u002Fdata\u002Fbin\u002Fmailservice`, a non-standard `\u002Fdata\u002Fbin\u002Fwebconsole`, and any file at `\u002Fdata\u002Fetc\u002Fld.so.preload`, which should not exist on a clean installation. Because the logging library may have been replaced, Brandefense advises relying on external evidence such as firewall and NetFlow logs, for example outbound connections to the two IP addresses above, rather than on the appliance's own logs alone.\n\n## Workarounds\n\nIf patching is not yet possible, Fortinet's advisory gives these workarounds:\n\n- Disable IBE in the GUI (Encryption > IBE, IBE Service off) or with the CLI: `config system encryption ibe`, `set status disable`, `end`.\n- Block internet access to the affected interface, or restrict it to trusted private networks.\n- Where a web application firewall sits in front of FortiMail, block POST requests to `\u002Fibe` containing `..\u002F`.\n\nAdministrators should check for the indicators above before and after upgrading, since installing a fixed build does not show whether the appliance was compromised beforehand.\n\n## Key points\n\n- An unauthenticated attacker can write arbitrary files via crafted HTTP or HTTPS requests to FortiMail's IBE request handler.\n- Affects FortiMail 7.2.0 to 7.2.9, 7.4.0 to 7.4.8, 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1; fixed in 7.4.9, 7.6.7 and 8.0.2.\n- Fortinet rates it CVSS 9.8 (v3.1) and says it has been exploited in the wild.\n- CISA added it to KEV on 1 October 2026, with a 4 October deadline for federal civilian agencies.\n- Workarounds: disable IBE, restrict access to trusted networks, or block POST requests to `\u002Fibe` containing `..\u002F` at a WAF.\n\n## Further reading & sources\n\n- [FG-IR-26-175: FortiMail path traversal (CVE-2026-104286)](https:\u002F\u002Fwww.fortiguard.com\u002Fpsirt\u002FFG-IR-26-175) (Fortinet PSIRT)\n- [Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F02\u002Ffortinet-fortimail-vulnerability-cve-2026-104286\u002F) (Help Net Security)\n- [FortiMail Zero-Day CVE-2026-104286 Is Under Attack With No Patch Yet](https:\u002F\u002Fwww.ibtimes.sg\u002Ffortimail-zero-day-cve-2026-104286-under-attack-no-patch-yet-94641) (International Business Times Singapore)\n- [CVE-2026-104286: FortiMail Zero-Day Arbitrary File Write](https:\u002F\u002Fbrandefense.io\u002Fblog\u002Fcve-2026-104286-fortimail-zero-day) (BRANDEFENSE Blog)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a",{"cves":19,"iocs":28,"malware":39,"timeline":50,"technologies":62},[20],{"id":12,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2026-104286",9.8,0.0457,"Critical",89.62,"3.1",[29,32,35,37],{"type":30,"value":31},"ip","79.141.169.187",{"type":33,"value":34},"other","archive234",{"type":33,"value":36},"\u002Fmigadmin",{"type":30,"value":38},"45.129.0.192",[40,42,44,46,48],{"name":41},"smit",{"name":43},"liblog.so",{"name":45},"webconsole",{"name":47},"mailservice",{"name":49},"ld.so.preload",[51,55,58],{"date":52,"event":53,"description":54},"2026-10-01","Disclosure","Fortinet PSIRT advisory FG-IR-26-175 published and CISA KEV listing",{"date":52,"event":56,"description":57},"Advisory published","Fortinet published security advisory",{"date":59,"event":60,"description":61},"2026-10-02","CISA KEV addition","CISA added CVE-2026-104286 to KEV catalog",[63],{"vendor":10,"product":11},"vulnerability_disclosure","2026-10-17T12:03:14.799873+00:00","2026-10-18T12:14:40.153142+00:00",null,{"articles":69},[70,81,92,103],{"slug":71,"title":72,"summary":73,"tags":74,"hero_image_url":79,"story_type":64,"created_at":80},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[75,76,14,77,78],"CVE-2026-18556","N-Able N-Central","RCE","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":82,"title":83,"summary":84,"tags":85,"hero_image_url":90,"story_type":64,"created_at":91},"cisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild","Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild","Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, on 9 September 2026 to confirm active exploitation that its PSIRT became aware of in August. CISA added the CVE to its KEV catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.",[86,87,88,14,89],"Cisco","CVE-2026-20079","FMC","auth-bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild.png?v=e25c4c61c3","2026-09-12T07:10:09.180903+00:00",{"slug":93,"title":94,"summary":95,"tags":96,"hero_image_url":100,"story_type":101,"created_at":102},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[97,98,77,14,99],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":104,"title":105,"summary":106,"tags":107,"hero_image_url":112,"story_type":113,"created_at":114},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day","In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.",[108,109,110,111,15],"Interlock","Cisco FMC","CVE-2026-20131","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","ransomware_incident","2026-08-31T07:05:12.614729+00:00"]