Loading story…
Fortinet disclosed CVE-2026-104286, a critical CVSS 9.8 zero-day in the FortiMail management interface that is under active exploitation. The path-traversal and improper null-byte-neutralization flaw allows an unauthenticated remote attacker to send crafted HTTP or HTTPS requests that write arbitrary files to the underlying appliance, potentially enabling code execution, command execution, system compromise, or service disruption. Affected versions are FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9; fixes for most affected branches were not yet available when the advisory was issued.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and required U.S. federal civilian agencies to perform forensic triage and mitigate it by October 4, 2026, although no known ransomware use was identified. Organizations should identify exposed FortiMail appliances, immediately restrict management-interface access to trusted private networks, disable Identity-Based Encryption (IBE) support where feasible, apply fixed releases as they become available, and review Fortinet-provided file, IP, and log indicators for evidence of compromise.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
CISA added the actively exploited Fortinet FortiMail vulnerability CVE-2026-104286 to its Known Exploited Vulnerabilities Catalog. It required forensic triage and directed affected federal civilian agencies to mitigate the vulnerability under BOD 26-04 guidance.
Fortinet disclosed CVE-2026-104286, a critical CVSS 9.8 FortiMail management-interface flaw that combines path traversal and null-byte handling weaknesses. Unauthenticated attackers can use crafted HTTP or HTTPS requests to write arbitrary files, potentially enabling code execution; Fortinet advised disabling IBE or restricting management access and published compromise indicators.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcerunzero.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed **CVE-2025-53681**, an SQL injection flaw in the FortiMail administrative portal that could let an authenticated, privileged attacker execute unauthorized code or commands on the email gateway through crafted HTTP or HTTPS requests. The vulnerability stems from improper neutralization of special elements in SQL commands (`CWE-89`) within the admin GUI, and Fortinet said it was discovered internally by Jaguar Perlas of the Fortinet Burnaby InfoSec team. Affected versions are FortiMail **7.6.0 through 7.6.3**, **7.4.0 through 7.4.5**, and **7.2.0 through 7.2.8**. Fortinet advised customers to upgrade to **7.6.4**, **7.4.6**, or **7.2.9** and later, while **FortiMail 8.0** is not affected. Fortinet rated the issue **Medium** with a CVSS v3 score of **6.3**, while the NVD scored it **7.2**; Fortinet said it had **no evidence of in-the-wild exploitation** at the time of disclosure.
Jul 10, 2026
A critical path traversal vulnerability in Fortinet FortiWeb, tracked as CVE-2025-64446, is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute administrative commands on affected FortiWeb appliances by abusing the management API to reach internal endpoints. GreyNoise observed weaponization of this vulnerability within 72 hours of its disclosure, with coordinated scanning activity originating from multiple IPs and hosting providers, indicating a rapid and organized exploitation effort. The vulnerability affects FortiWeb versions 7.0 through 8.0, and exploit attempts have been detected using uniform TLS fingerprints, suggesting the use of automated tools. CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch the flaw within a specified deadline. Another FortiWeb zero-day, CVE-2025-58034, was also disclosed and patched, but CVE-2025-64446 is noted as the more critical issue due to its unauthenticated attack vector and higher CVSS score. Security researchers emphasize the urgency of patching FortiWeb appliances to prevent unauthorized access and potential compromise, as exploitation is ongoing and targeting a broad range of organizations.
Jun 29, 2026
A critical vulnerability, CVE-2025-64446, affecting Fortinet FortiWeb web application firewall devices has been actively exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, present in FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, and earlier branches, allows unauthenticated remote attackers to bypass authentication and execute administrative commands via crafted HTTP or HTTPS requests. Attackers have leveraged this vulnerability to create unauthorized administrative accounts, such as "Testpoint" and "trader," enabling persistent and undetected access to affected systems. Fortinet has released patches in version 8.0.2 and equivalent updates, but exploitation continues against unpatched devices, exposing organizations to significant risk of compromise and data exposure. CISA's inclusion of CVE-2025-64446 in the KEV catalog underscores the urgency of remediation, especially for U.S. federal agencies, which have been mandated to patch vulnerable FortiWeb systems by November 21, 2025. The agency also strongly advises all organizations to prioritize remediation of this and other KEV-listed vulnerabilities to reduce exposure to active cyber threats. The vulnerability's exploitation highlights the ongoing risk posed by unpatched perimeter security devices and the importance of timely vulnerability management in defending against sophisticated attacks.
Jun 29, 2026