<![CDATA[🔴 Critical: Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes]]>

<![CDATA[🔴 Critical: Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes]]>CISA has added a critical Fortinet FortiMail vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation in the wild. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8, placing it in the critical severity range.

The vulnerability allows unauthenticated attackers to write arbitrary files on the underlying system. CISA's addition of the flaw to the KEV catalog confirms that threat actors are actively targeting it, making patching a priority for affected organizations.

Given the unauthenticated nature of the attack vector and the potential for arbitrary file writes to lead to further compromise, administrators running FortiMail should treat this as an urgent item. Review your exposure, apply available fixes from Fortinet, and monitor for signs of exploitation.

Source: The Hacker News

Has your organization deployed FortiMail, and if so, what steps are you taking to address this actively exploited flaw?

]]>https://xploitlk.com/topic/537/critical-critical-fortimail-zero-day-flaw-exploited-in-attacks-allows-unauthenticated-arbitrary-file-writesRSS for NodeTue, 27 Oct 2026 10:13:21 GMTFri, 02 Oct 2026 06:30:23 GMT60