important · Edge — RCE
Attackers are using FortiMail’s public management interface for credential-free file writes and appliance code execution.
Affects
Fortinet FortiMail, a physical, virtual and cloud-deployed secure email gateway.
A crafted HTTP or HTTPS request combines path traversal with NULL-byte handling to write or replace files outside the intended path.
Detail and 4 sources
Observed compromises included attacker-added binaries, ld.so.preload modification and root cron activity.
A patch was announced, but current release availability could not be resolved from the retrieved vendor material.
Today’s change is the confirmed scope: the arbitrary-file-write primitive is now connected to persistence and command execution using root-level mechanisms.
Sources
ResearchKrytyczna podatność w FortiMail aktywnie wykorzystywana w atakach
– moje.cert.plCode / PoCAn improper limitation of a pathname to a restricted... · CVE-2026-104286 · GitHub Advisory Database · GitHubVendorFortinet warns of critical FortiMail flaw exploited in zero-day attacksVendorA Vulnerability in Fortinet FortiMail Could Allow for Arbitrary Code Execution