Act
archived
Fortinet warns of critical FortiMail zero-day flaw under active attack
- Engineer — Act: CISA KEV listed, public PoC available, and active exploitation confirmed — patch FortiMail to Fortinet’s recommended fixed version immediately; treat any unpatched internet-facing FortiMail instance as potentially compromised.
- SOC/IR — Act: Active zero-day exploitation of a network-edge email gateway warrants an assume-breach posture — sweep FortiMail logs for anomalous command execution or outbound connections since the first reported exploitation date, and tune detections for post-compromise activity on devices in that network segment.
- Leader — Act: Confirm whether your organization runs FortiMail and verify emergency patching is underway; CISA KEV listing on an actively exploited edge appliance may warrant a brief to leadership given potential for email interception and lateral movement.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.