Fortinet says FortiMail flaw is under active attack

Fortinet warned that a critical flaw in FortiMail was being used in zero-day attacks. The company said the issue carried a 9.8 CVSS score and affected the product’s management interface.

Fortinet said the bug could let an unauthenticated attacker write arbitrary files on the underlying system through crafted web requests. Gwendal Guégniaud of Fortinet’s Product Security team found it internally, and the affected releases were 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9.

For FortiMail 7.2, Fortinet said customers could move to 7.4 or later. It said patches were still due for 7.4, 7.6 and 8.0, and told administrators to disable IBE support or keep management access off the public internet.

Fortinet also published indicators of compromise, including two IP addresses and example log entries showing an archive account, a cron job, an admin logout, a decryption error and failed login attempts. It said it was coordinating with government organisations, including CISA, and it did not say when the attacks started, how many systems were affected or who was responsible.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue and required federal agencies to carry out forensic triage and mitigation by 4 October.