[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRtqkmk0kNTgUzQS7-itrXMraL91pcNX13hflumpBnCE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"e8bee184-4210-4a01-81f6-54608856a5af","fortinet-fortimail-zero-day-exploited-in-the-wild-before-patch-available","b8e3ffd3-fb58-4095-8279-66c4515c6316","Fortinet FortiMail Zero-Day Exploited in the Wild Before Patch Available","A critical path traversal zero-day vulnerability in Fortinet FortiMail (CVE-2026-104286) is being actively exploited before a patch is available, leaving organizations reliant on workarounds to reduce exposure. The flaw allows attackers to write arbitrary files and potentially execute remote code, making it a high-severity threat to email gateway infrastructure. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog and the three-day remediation mandate for federal agencies underscores the urgency of the risk. This incident highlights the danger of internet-facing security appliances that themselves become attack vectors, and the critical importance of having compensating controls ready when patches are unavailable.","**Immediate actions:**\n- Apply Fortinet's recommended workarounds immediately by disabling the IBE feature or restricting web management interface access to trusted IP ranges only.\n- Add CVE-2026-104286 to your internal vulnerability tracking system and assign ownership for remediation within 24 hours.\n- Audit all internet-facing FortiMail instances and isolate any that cannot have workarounds applied promptly.\n\n**Detection measures:**\n- Enable enhanced logging on FortiMail appliances and forward logs to your SIEM to detect anomalous file write activity or unexpected process execution.\n- Subscribe to Fortinet's PSIRT advisories and CISA's KEV catalog feeds to receive real-time alerts on newly disclosed exploited vulnerabilities.\n\n**Long-term improvements:**\n- Establish a formal emergency patching procedure with defined SLAs (e.g., 24–72 hours) for critically exploited vulnerabilities affecting internet-facing systems.\n- Implement network segmentation to ensure email gateway appliances are isolated from internal networks, limiting lateral movement if compromised.\n- Maintain a continuously updated inventory of all security appliances, including firmware versions, to enable rapid impact assessment when zero-days emerge.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST CM-7: Least Functionality","CISA KEV Catalog Mandate (BOD 22-01)","ISO\u002FIEC 27002:2022 Control 8.8: Management of Technical Vulnerabilities","ITIL Change Management: Emergency Change Procedure",{},"published","2026-10-02T10:21:51.819557+00:00","2026-10-02T10:21:51.735+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fexploited-fortinet-fortimail-zero-day-calls-for-urgent-action\u002F","exploited-fortinet-fortimail-zero-day-calls-for-urgent-action-37b7c8","Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"faf4ceef-c23f-4902-b3c2-971b5b527a35","2026-10-02","afternoon","ThreatNoir Afternoon Brief — October 2","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-02\u002Fthreatnoir-afternoon-brief-2026-10-02.mp3",[57,60,63],{"slug":34,"name":58,"problem":59},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":46,"name":61,"problem":62},"Automated patch management","Known holes get closed in days, not months.",{"slug":64,"name":65,"problem":66},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]