Fortinet FortiMail (versions 7.2.0–8.0.1)
Fortinet's enterprise email security gateway, used by organisations to filter and manage inbound and outbound email.
Root Cause
The software fails to properly validate file path inputs and sanitise null byte characters in HTTP and HTTPS requests, allowing a crafted request to escape the intended file directory entirely.
Attack Vector
An attacker sends a specially crafted HTTP or HTTPS request to the FortiMail management interface. The server mishandles the path, allowing the attacker to write a file — such as a web shell — to an arbitrary location, potentially achieving full remote code execution (the ability to run any command on the target machine).
Recommended Actions
- Disable IBE feature support in FortiMail immediately, as Fortinet advises.
- Block public access to the FortiMail management interface; restrict it to trusted IP addresses only.
- Review Fortinet's published indicators of compromise (IoCs — specific technical signatures of an attack) to check whether exploitation has already occurred in your environment.
CISA has added this CVE to its Known Exploited Vulnerabilities catalogue and is requiring federal agencies to act within three days. Patches are expected in versions 7.4.9, 7.6.7, and 8.0.2, with no release date confirmed.