[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5HxAV7fYDNZKryP-5N29IKeu235I6bdKfopqI-0CTbs":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b8e3ffd3-fb58-4095-8279-66c4515c6316","Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action","exploited-fortinet-fortimail-zero-day-calls-for-urgent-action-37b7c8","CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system. The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek.","CISA and Fortinet have issued warnings about a critical zero-day vulnerability, CVE-2026-104286, affecting multiple versions of FortiMail. This path traversal flaw allows attackers to write arbitrary files and potentially execute code. The vulnerability has reportedly been exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities catalog, mandating federal agencies to address it within three days. While patches are not yet available, Fortinet recommends disabling the IBE feature or restricting web management access as workarounds.","Fortinet FortiMail zero-day vulnerability (CVE-2026-104286) exploited in the wild.","https:\u002F\u002Fwww.securityweek.com\u002Fexploited-fortinet-fortimail-zero-day-calls-for-urgent-action\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FFortinet-Vulnerability.jpg","2026-10-02T08:07:33+00:00","2026-10-02T10:00:06.090528+00:00",9,[17,20,23],{"name":18,"type":19},"FortiMail","product",{"name":21,"type":22},"Fortinet","vendor",{"name":24,"type":19},"IBE feature","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"cve","CVE-2026-104286","Critical path traversal vulnerability in FortiMail",[21,18,24],{"controls":55,"vendors":142},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":47,"name":115,"problem":116,"products":117},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[143],{"slug":144,"name":21,"logo_path":145,"roles":146},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":163},"fortinet-fortimail-zero-day-exploited-in-the-wild-before-patch-available","Fortinet FortiMail Zero-Day Exploited in the Wild Before Patch Available","A critical path traversal zero-day vulnerability in Fortinet FortiMail (CVE-2026-104286) is being actively exploited before a patch is available, leaving organizations reliant on workarounds to reduce exposure. The flaw allows attackers to write arbitrary files and potentially execute remote code, making it a high-severity threat to email gateway infrastructure. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog and the three-day remediation mandate for federal agencies underscores the urgency of the risk. This incident highlights the danger of internet-facing security appliances that themselves become attack vectors, and the critical importance of having compensating controls ready when patches are unavailable.",[153,154,155,156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST CM-7: Least Functionality","CISA KEV Catalog Mandate (BOD 22-01)","ISO\u002FIEC 27002:2022 Control 8.8: Management of Technical Vulnerabilities","ITIL Change Management: Emergency Change Procedure",{}]