关键的 FortiMail 零日漏洞在攻击中被利用，允许未经身份验证的任意文件写入

美国网络安全和基础设施安全局 (CISA) 周四将影响 Fortinet FortiMail 的一个关键安全漏洞添加到其已知被利用漏洞 (KEV) 目录中，此前有关于该漏洞被积极利用的报告。

该漏洞的追踪 ID 为 CVE-2026-104286（CVSS 分数：9.8），允许未经身份验证的攻击者在底层系统上写入任意文件。

Fortinet 在一份公告中表示：“对路径名的限制不当，导致访问受限目录（‘路径遍历’）[CWE-22]，以及对 NULL 字节或 NULL 字符的不当中和 [CWE-158] 漏洞，可能允许未经身份验证的攻击者通过精心构造的 HTTP 或 HTTPS 请求在底层系统上写入任意文件。”

该漏洞影响以下版本 -

FortiMail 8.0.0 至 8.0.1（升级到即将发布的 8.0.2 或更高版本）

FortiMail 7.6.0 至 7.6.6（升级到即将发布的 7.6.7 或更高版本）

FortiMail 7.4.0 至 7.4.8（升级到即将发布的 7.4.9 或更高版本）

FortiMail 7.2.0 至 7.2.9（升级到 7.4 分支或更高版本）

Fortinet 已确认该漏洞在野外被利用，敦促客户在某些版本的修复可用之前，应用以下变通方法 -

使用以下 CLI 命令禁用 IBE 功能支持：

config system encryption ibe

set status disable

end

禁用从互联网访问 FortiMail 管理界面的权限，或仅限制来自受信任的私有网络的访问。

Fortinet 感谢 Fortinet 产品安全团队的 Gwendal Guégniaud 发现并报告了该漏洞。它分享了以下妥协指标 -

IP 地址 -

79.141.169[.]187

45.129.0[.]192

文件 -

/data/lib/liblog.so（已添加）

/data/bin/webconsole（已添加）

/data/bin/mailservice（已添加）

/data/etc/ld.so.preload（已添加）

/bin/smit（已修改）

/data/etc/httpd.conf（已修改）

/data/migadmin.tar.gz（已修改）

鉴于该漏洞正在被积极利用，建议联邦文职执行机构 (FCEB) 在 2026 年 10 月 4 日之前应用补丁或变通方法。

这一发展发生在 Check Point（CVE-2026-85102 和 CVE-2026-93616）、Arista VeloCloud Orchestrator（CVE-2026-93952）、F5 BIG-IP 访问策略管理器（CVE-2026-94127）、思科 Catalyst SD-WAN 管理器（CVE-2026-76504）以及 Citrix NetScaler ADC 和 NetScaler Gateway（CVE-2026-88771 和 CVE-2026-88772）等多个安全漏洞也遭到野外利用的背景下。

觉得这篇文章有趣吗？请在 Google 新闻、Twitter 和 LinkedIn 上关注我们，阅读更多我们发布的独家内容。

相关漏洞

CVE-2026-104286 CVSS 9.8 CRITICAL Analyzed

CVE-2026-104286 - Fortinet FortiMail Path Traversal Vulnerability - [Actively Exploited]

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

CVE-2026-76504 CVSS 9.8 CRITICAL Analyzed

CVE-2026-76504 - Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability - [Actively Exploited]

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

CVE-2026-88772 CVSS 9.5 CRITICAL Analyzed

CVE-2026-88772 - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability - [Actively Exploited]

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

CVE-2026-88771 CVSS 9.8 CRITICAL Analyzed

CVE-2026-88771 - Citrix NetScaler Improper Input Validation Vulnerability - [Actively Exploited]

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

CVE-2026-94127 CVSS 9.8 CRITICAL Analyzed

CVE-2026-94127 - F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability - [Actively Exploited]

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-93616 CVSS 9.8 CRITICAL Analyzed

CVE-2026-93616 - Check Point Multiple Products Path Traversal Vulnerability - [Actively Exploited]

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

CVE-2026-93952 CVSS 10 CRITICAL Analyzed

CVE-2026-93952 - Arista VeloCloud Orchestrator Improper Input Validation Vulnerability - [Actively Exploited]

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVE-2026-85102 CVSS 9.8 CRITICAL Analyzed

CVE-2026-85102 - Check Point Multiple Products Improper Certificate Validation Vulnerability - [Actively Exploited]

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

关键的 FortiMail 零日漏洞在攻击中被利用，允许未经身份验证的任意文件写入

相关漏洞

更多来自 The Hacker News