Business email gateways (FortiMail) are under attack.

What's happening.

FortiMail is an email security gateway that filters company email. A path traversal flaw lets an attacker send a crafted web request that writes files anywhere on the underlying system. They do not need to log in.

Fortinet rates it critical and says it has been used in real attacks.

What it means for you.

Writing files to the gateway can lead to full control of it. A mail gateway sees all your inbound and outbound email, so an attacker could read messages, redirect them, or use it to send convincing phishing from your own domain.

How to fix it.

1. Update to FortiMail 8.0.2, 7.6.7 or 7.4.9, whichever matches your branch.
2. FortiMail 7.2 has a fix due in 7.2.10. FortiMail 7.0 has no fix, so plan to move to a supported release.
3. FortiMail Cloud customers do not need to act. Fortinet fixed it on 5 Oct 2026.
4. Until you can update, Fortinet suggests turning off the IBE service and limiting webmail access to trusted private networks.
5. Fortinet's advisory lists signs of compromise to look for, including unexpected admin logouts and an archive account you did not create.