Fortinet FortiMail: Schwachstelle ermöglicht Manipulation von Dateien
WID-SEC-2026-3701 · first 02.10.2026 · updated 02.10.2026 · CVSS 9,8
What it is about
FortiMail ist eine Aplliance zum Schutz gegen die von E-Mails übertragenen Bedrohungen. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortinet FortiMail ausnutzen, um Dateien zu manipulieren.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- Dateien zu manipulieren
Am I affected?
Affected according to the BSI:
- Fortinet FortiMail <8.0.2
- Fortinet FortiMail <7.6.7
- Fortinet FortiMail <7.4.9
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Fortinet FortiMail 8.0.2
- Fortinet FortiMail 7.6.7
- Fortinet FortiMail 7.4.9
Is the vulnerability already being exploited?
- CVE-2026-104286: exploited in the wild according to CISA, in the catalogue since 01.10.2026.
Information and sources
- Original BSI advisory (WID)
- Fortinet Advisory vom 2026-10-01 fortiguard.fortinet.com
- CISA KEV CVE-2026-104286 www.cisa.gov
CVE: CVE-2026-104286
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.