[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6-Grb1neiZ6HKMM8rd3P9mw_Qmt4Y5EVx8rjJTwrGEY":3},{"article":4,"iocs":46,"watch_terms":80,"solutions":81,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"67f8c660-d015-456d-b41e-71aecb9ada62","Fortinet warns of critical FortiMail flaw exploited in zero-day attacks","fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks-b4ba5b","Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]","Fortinet has issued a critical warning regarding CVE-2026-104286, a vulnerability in the FortiMail management interface that is actively being exploited in zero-day attacks. The flaw allows unauthenticated attackers to write arbitrary files to the system, potentially leading to unauthorized code execution. Fortinet has provided workarounds and is working on security updates for affected versions.","Fortinet warns of critical FortiMail vulnerability CVE-2026-104286 exploited in zero-day attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F10\u002F14\u002FFortinet.jpg","2026-10-01T22:42:49+00:00","2026-10-02T00:00:05.667446+00:00",9,[17,20],{"name":18,"type":19},"FortiMail","product",{"name":21,"type":22},"Fortinet","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,55,58,61,64,67,70,73,77],{"type":48,"value":49,"context":50},"cve","CVE-2026-104286","Critical FortiMail vulnerability",{"type":52,"value":53,"context":54},"hash_sha256","8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84","Added file \u002Fdata\u002Flib\u002Fliblog.so on compromised systems",{"type":52,"value":56,"context":57},"77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a","Modified file \u002Fbin\u002Fsmit on compromised systems",{"type":52,"value":59,"context":60},"7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38","Added file \u002Fdata\u002Fbin\u002Fwebconsole on compromised systems",{"type":52,"value":62,"context":63},"4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b","Added file \u002Fdata\u002Fbin\u002Fmailservice on compromised systems",{"type":52,"value":65,"context":66},"703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5","Modified file \u002Fdata\u002Fetc\u002Fhttpd.conf on compromised systems",{"type":52,"value":68,"context":69},"8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6","Added file \u002Fdata\u002Fetc\u002Fld.so.preload on compromised systems",{"type":52,"value":71,"context":72},"d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3","Modified file \u002Fdata\u002Fmigadmin.tar.gz on compromised systems",{"type":74,"value":75,"context":76},"ip","79.141.169.187","IP address associated with attacks, used for remote server configuration",{"type":74,"value":78,"context":79},"45.129.0.192","IP address associated with attacks",[21,18],{"controls":82,"vendors":170},[83,112,141],{"slug":84,"name":85,"problem":86,"products":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":113,"name":114,"problem":115,"products":116},"patch-management","Automated patch management","Known holes get closed in days, not months.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":142,"name":143,"problem":144,"products":145},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[146,154,162],{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","secure-firewall","Cisco Secure Firewall","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Ffirewalls\u002Findex.html","Next-generation firewalls with intrusion prevention, using Talos threat intelligence.",{"vendor_slug":163,"vendor_name":164,"vendor_logo":165,"product_slug":166,"product_name":167,"url":168,"description":169},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",[171],{"slug":172,"name":21,"logo_path":173,"roles":174},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[175,176],"affected","reported_by",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":192},"critical-fortimail-zero-day-enables-unauthenticated-file-write-and-code-execution","Critical FortiMail Zero-Day Enables Unauthenticated File Write and Code Execution","CVE-2026-104286 represents a critical zero-day vulnerability in Fortinet's FortiMail management interface that allows unauthenticated attackers to write arbitrary files, potentially achieving full remote code execution. The fact that it is being actively exploited before a full patch is available underscores the danger of exposing management interfaces directly to the internet. Organizations relying on FortiMail as a security gateway face the paradox of their protective infrastructure becoming an attack vector. This incident highlights how security appliances themselves must be treated as high-value targets requiring their own hardened configurations and rapid response procedures.",[182,183,184,185,186,187,188,189,190,191],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-40 – Guide to Enterprise Patch Management","NIST SI-2 – Flaw Remediation","NIST AC-17 – Remote Access","NIST SC-7 – Boundary Protection","NIST IR-4 – Incident Handling","ISO\u002FIEC 27001 – A.12.6.1 Management of Technical Vulnerabilities","ITIL – Change and Release Management (Emergency Change Procedure)",{}]