FORTINET WARNS OF CRITICAL FORTIMAIL FLAW EXPLOITED IN ZERO-DAY ATTACKS

Summary from the TLDR InfoSec newsletter

Attackers are exploiting CVE-2026-104286 as a zero-day, a CVSS 9.8 path traversal and NULL byte flaw in the FortiMail management interface that lets unauthenticated HTTP requests write arbitrary files and execute code. FortiMail 7.2.0 through 8.0.1 is affected, and fixed builds 7.4.9, 7.6.7, and 8.0.2 are not yet available, so admins should disable IBE or restrict the management interface to trusted networks. Compromise indicators include an added /data/etc/ld.so.preload and /data/lib/liblog.so, plus an archive account named archive234 pointing to 79[.]141[.]169[.]187, and CISA gave federal agencies until October 4 to triage and mitigate.