{"id":3336,"date":"2026-10-02T06:46:49","date_gmt":"2026-10-02T06:46:49","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3336"},"modified":"2026-10-02T06:46:49","modified_gmt":"2026-10-02T06:46:49","slug":"critical-fortimail-zero-day-flaw-exploited-in-attacks-allows-unauthenticated-arbitrary-file-writes","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3336","title":{"rendered":"Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 02, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Enterprise Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhhcZguz-U3FsSD6t4YQ45EeFbgnWAy9lM28OAFydsLXZYzOS00aOD7pxUZcgvLMfMAO3SJV_Amu9SoNezLNQOvx823Z92CpqC5ow9XO3d7HJhEKZlwQt4H4Z7kirDwGcSrUyi1ONs_PuULNYjEjzae2c1mncDviOT9iqxD-PhmXCYpulTUNO2rtW5c9AAx\/s1700-nu-rw-lo-l85-e365\/fortimail.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/01\/cisa-adds-one-known-exploited-vulnerability-catalog\" target=\"_blank\">added<\/a> a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (<a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\">KEV<\/a>) catalog, following reports of active exploitation.<\/p>\n<p>The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.<\/p>\n<p>\u00abAn improper limitation of a pathname to a restricted directory (&#8216;path traversal&#8217;) [CWE-22] and improper neutralization of NULL byte or NULL character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests,\u00bb Fortinet <a href=\"https:\/\/fortiguard.fortinet.com\/psirt\/FG-IR-26-175\" target=\"_blank\">said<\/a> in an advisory.<\/p>\n<p>The vulnerability impacts the following versions &#8211;<\/p>\n<ul>\n<li>FortiMail 8.0.0 through 8.0.1 (Upgrade to upcoming 8.0.2 or above)<\/li>\n<li>FortiMail 7.6.0 through 7.6.6 (Upgrade to upcoming 7.6.7 or above)<\/li>\n<li>FortiMail 7.4.0 through 7.4.8 (Upgrade to upcoming 7.4.9 or above)<\/li>\n<li>FortiMail 7.2.0 through 7.2.9 (Upgrade to branch 7.4 or above)<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/growth-ai-control-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVYuoalvwUlwvLZFDideJ8jW4rz-IodX0Lwi7uyP7Ab0wiDeu_BqVhPDdejQQ65MC3p9Xc4MApnHz56NJ5SDc1HMg0DvozkkGYv9TGtDLCh26v1yD5-GyzQxnA5-6A6B4beW96H_6FyrByq22cvU5JDF-i8e5GIfV4wg1SpCvjwAJt74FaqkAb2gzqE7ll\/s728-nu-rw-lo-l85-e365\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Fortinet has acknowledged that the vulnerability has been exploited in the wild, urging customers to apply the following workarounds until fixes are available for certain versions &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<ul>\n<li>Disable IBE feature support using the following CLI command:<\/li>\n<\/ul>\n<pre>config system encryption ibe\nset status disable\nend\n<\/pre>\n<ul>\n<li>Disable access to the FortiMail management interface from the internet or restrict access only from trusted private networks.<\/li>\n<\/ul>\n<p>Fortinet credited Gwendal Gu\u00e9gniaud of the Fortinet Product Security team with discovering and reporting the flaw. It has shared the following indicators of compromise &#8211;<\/p>\n<ul>\n<li>\n    IP addresses &#8211;<\/p>\n<ul>\n<li>79.141.169[.]187<\/li>\n<li>45.129.0[.]192<\/li>\n<\/ul>\n<\/li>\n<li>\n    Files &#8211;<\/p>\n<ul>\n<li>\/data\/lib\/liblog.so (added)<\/li>\n<li>\/data\/bin\/webconsole (added)<\/li>\n<li>\/data\/bin\/mailservice (added)<\/li>\n<li>\/data\/etc\/ld.so.preload (added)<\/li>\n<li>\/bin\/smit (modified)<\/li>\n<li>\/data\/etc\/httpd.conf (modified)<\/li>\n<li>\/data\/migadmin.tar.gz (modified)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patch or workarounds by October 4, 2026.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The development comes as number of security flaws in Check Point (CVE-2026-85102 and CVE-2026-93616), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP Access Policy Manager (CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), and Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) have come under in-the-wild exploitation.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 02, 2026Vulnerability \/ Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3337,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1222,24,58,128,537,70,3626,725,2427,126],"class_list":["post-3336","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-arbitrary","tag-attacks","tag-critical","tag-exploited","tag-file","tag-flaw","tag-fortimail","tag-unauthenticated","tag-writes","tag-zeroday"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3336"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3336\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3337"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}