Email gateways have one job: stand between your inbox and the internet's worst impulses. So there's a special kind of irony when the bouncer turns out to have a door in the back that anyone can walk through. This week, that bouncer was Fortinet's FortiMail.
A 9.8 Nobody Wanted to See
Fortinet disclosed CVE-2026-104286, a critical flaw in FortiMail with a CVSS score of 9.8, and it's already being exploited in the wild. The bug combines path traversal (CWE-22) with a failure to properly neutralize NULL bytes (CWE-158), letting an unauthenticated attacker write arbitrary files to the underlying system using crafted HTTP or HTTPS requests.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies until October 4 to patch, a deadline short enough to tell you how worried they are. Fixes are out: upgrade 8.0.x to 8.0.2+, 7.6.x to 7.6.7+, 7.4.x to 7.4.9+, and if you're still on 7.2.x, move up to 7.4 or later. Can't patch yet? Fortinet recommends disabling the IBE (Identity-Based Encryption) feature via the CLI and limiting management interface access to trusted networks.
Read the File List Like a Crime Scene
The indicators of compromise are the part worth reading slowly. Investigators found new files including liblog.so, webconsole, mailservice, and an ld.so.preload, plus tampered versions of the smit binary, httpd.conf, and migadmin.tar.gz. A rogue ld.so.preload is the attacker's way of saying "I'll be loading myself into every process now, thanks," which is the opposite of a drive-by.
The angle most people miss: patching closes the door but doesn't evict whoever already walked in. If your FortiMail was exposed before you updated, compare it against those IoCs and the attacker IPs Fortinet published (79.141.169[.]187 and 45.129.0[.]192). Security appliances sit at the edge with broad trust and are rarely watched as closely as the servers behind them, so they make an ideal place for an attacker to settle in.
Your email gateway is supposed to be the thing that catches threats, not the thing that needs catching. Patch today and check for leftovers tomorrow.
Edge devices, plugins, and dependencies all fail the same way, quietly and with too much trust, so if you'd like a second set of eyes on what your website is trusting, let's talk.
Source: The Hacker News