FortiMail Zero-Day Exploited; CISA Adds CVE-2026-104286 to KEV

En bref

• CVE-2026-104286 affects Fortinet's FortiMail email security appliance.
• Unauthenticated actors can write files anywhere and reach the host system.
• CVSS score of 9.8 puts the flaw at the top of the severity range.
• CISA added it to the Known Exploited Vulnerabilities catalog on Thursday, October 2026.
• Real-world attacks are underway, so patching windows are closing.

Fortinet's FortiMail secure email gateway carries a maximum-severity defect, tracked as CVE-2026-104286, that lets someone who has never authenticated place files wherever they like on the appliance. Because those writes reach the underlying operating system, the same flaw effectively hands an intruder a foothold on the host without any credentials at all. NIST-style scoring places it at 9.8, and on a Thursday in October 2026 the U.S. cybersecurity agency moved it into its list of bugs known to be used in real intrusions.

That catalog entry is more than paperwork. Inclusion means the government has seen evidence of live abuse, and it starts a countdown clock obliging federal civilian agencies to remediate within a set window. For state, local, and education entities there is no such mandate, but the practical risk is identical: an internet-facing mail security box that can be compromised anonymously is an attractive first hop.

K-12 districts that run FortiMail on premises are the most exposed. These appliances typically sit at the network edge to filter spam and malware before messages reach Exchange or Google Workspace, so they are reachable from anywhere. An adversary who drops a web shell or overwrites a configuration file can persist quietly, harvest credentials passing through, or use the device as a staging point for lateral movement into student information systems and administrative networks.

The absence of an authentication requirement is what makes this so dangerous. Skilled operators no longer need stolen passwords or a phishing lure; automated scanning can locate unpatched boxes and exploit them at scale. KEV placement also signals that criminal or state-linked groups already know the recipe, which shortens the gap between disclosure and mass exploitation.

What to watch: Fortinet's advisory and fixed firmware builds, any vendor-published indicators of compromise, and signs of unusual file creation or outbound connections from mail gateways. Districts should treat every unpatched FortiMail instance as compromised until proven otherwise, and should expect follow-on activity such as credential theft or ransomware pre-positioning in the weeks ahead.

À faire maintenant

1. Inventory every FortiMail appliance in the environment, including forgotten or lab units, and confirm the installed firmware build.
2. Apply Fortinet's patched firmware immediately; if a fix is not yet available, take the management and mail interfaces off the public internet.
3. Hunt for attacker artifacts: unexpected files, modified web or config directories, new scheduled tasks, and suspicious outbound sessions from the appliance.
4. Rotate all credentials, API keys, and certificates that touch the device, since unauthenticated access may have exposed them.
5. Restrict administrative access to a dedicated management VLAN with MFA and source-IP allowlists; never expose admin portals directly.
6. Enable full logging to a remote SIEM and monitor for repeat exploitation attempts against the vulnerable endpoint.
7. Report confirmed compromises to CISA and the relevant sector ISAC, and check the KEV catalog for remediation deadlines.

Références CVE

• CVE-2026-104286

Source originale

The Hacker News