FortiMail Zero-Day Under Active Attack: Patch Now

Active Exploitation of Critical FortiMail Flaw

CISA has added a critical zero-day vulnerability in Fortinet FortiMail (CVE-2026-104286, CVSS 9.8) to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. The flaw allows unauthenticated attackers to write arbitrary files to the underlying system—a dangerous capability that can lead to remote code execution, backdoor installation, or full system compromise. Organizations running FortiMail appliances face immediate risk and should treat this as a patch-now emergency.

What This Means for SMBs

Email security gateways like FortiMail sit at a critical chokepoint in your infrastructure. A compromise here doesn't just mean lost email—it can provide attackers a foothold to move laterally into your network, exfiltrate data, or deploy ransomware. For SMBs without 24/7 security operations, vendor appliances often run unmonitored until something breaks. If you're running FortiMail, verify your version immediately and apply Fortinet's patch. If patching requires downtime or vendor assistance, don't delay—the exploit is already in attackers' hands. This is also a reminder that even enterprise-grade security appliances require active patch management and monitoring.

Read the full report from The Hacker News

Need help auditing your security infrastructure or managing vendor patches? O-Cyrus provides security assessments and infrastructure management tailored for small and mid-sized businesses. Contact us to ensure your defenses stay current.