Act
archived
Critical FortiMail Zero-Day (CVE-2026-104286) Actively Exploited
- Engineer — Act: CISA KEV-listed, public PoC exists, and active exploitation confirmed — unauthenticated arbitrary file write on FortiMail (CVSS 9.8). Identify all FortiMail instances and apply Fortinet’s patch immediately; treat unpatched appliances as potentially compromised.
- SOC/IR — Act: Active exploitation of an internet-facing email gateway means assume-breach posture for any unpatched FortiMail appliance; hunt for anomalous file creation events and unexpected processes spawned from the FortiMail service since the KEV listing date.
- Leader — Plan: A KEV-listed critical on email gateway infrastructure warrants confirming with engineering this week that all FortiMail deployments are inventoried and on the emergency patch queue — not board-level systemic risk, but email compromise has compliance and data-exposure implications worth tracking.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.