Warning: Actively Exploited FortiMail Vulnerability, Patch Immediately!
ID: 52e6663d-a1bc-5497-8580-4719b69d5b7a
STIX ID: report--52e6663d-a1bc-5497-8580-4719b69d5b7a
Threat Score
A critical, actively exploited zero-day in Fortinet FortiMail (CVE-2026-104286, CVSS 9.8) enables unauthenticated remote arbitrary file write via a path traversal and NULL-byte handling bug in the IBE feature, allowing full device takeover; Fortinet and CISA reported active exploitation. The advisory provides immediate mitigation (disable IBE or block /ibe), patch guidance (upgrade to 8.0.2, 7.6.7, 7.4.9), detailed IoCs (modified/added files, IPs, logs), and extensive post-compromise remediation and monitoring recommendations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.