Email security gateways have one job: stand at the door and keep the bad stuff out. So there's a special kind of irony when the bouncer turns out to have a side entrance that lets strangers rearrange the furniture. That's this week's Fortinet news in a nutshell.
A Path Traversal With a Perfect-Ish Score
CISA added CVE-2026-104286, a critical flaw in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog on October 1, 2026, confirming it's being exploited in the wild. The bug carries a CVSS score of 9.8 and combines path traversal with improper null byte handling, letting an unauthenticated attacker write arbitrary files on the system using crafted HTTP or HTTPS requests.
Affected releases span FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1. Fixes land in 7.4.9, 7.6.7, and 8.0.2 or later, while anyone still on the 7.2 branch needs to move up to 7.4 or above. Federal civilian agencies have until October 4 to patch or apply workarounds, and Fortinet suggests disabling the IBE feature or locking the management interface to trusted networks in the meantime.
Unauthenticated File Writes Are Never Just File Writes
"Arbitrary file write" sounds a bit dull until you remember that on an appliance, writing the right file in the right place is often a short hop from running code. No credentials needed, internet-facing by design, sitting right in the path of every message your company sends and receives. Attackers aren't exactly spoiled for better targets.
The part people tend to miss is the management interface. A lot of these appliance zero-days only work because the admin panel is reachable from the open internet, which is a bit like putting the server room key under the welcome mat and hoping nobody owns a flashlight. Patching fixes this bug. Restricting access to admin surfaces fixes a whole category of future ones.
Patch it today, check those indicators of compromise, and then go see what else in your stack has an admin panel facing the whole planet.
If your CMS login page is just as reachable as that FortiMail admin panel, I'd be happy to help you lock down your site's exposed surfaces before someone else goes looking for them.
Source: The Hacker News