Citrix NetScaler SAML Zero-Day (CVE-2026-88779) Exploited in Attacks: Fixed Versions and Next Steps
CVE-2026-88779 in SAML-enabled NetScaler ADC and Gateway was exploited before a patch. Attackers inject commands via the username field. Patch now.
Vulnerabilities
Critical FortiMail Zero-Day CVE-2026-104286 Exploited in the Wild: Patch Your Email Gateways Now
CVE-2026-104286 (CVSS 9.8) lets unauthenticated attackers write arbitrary files on FortiMail and is actively exploited. See patches and mitigations.
Fortinet has confirmed that attackers are already exploiting a critical vulnerability in its FortiMail email gateway. The flaw, tracked as CVE-2026-104286, has a CVSS score of 9.8. It lets an attacker write arbitrary files to the device’s file system without logging in.
What’s the problem?
The vulnerability chains two weaknesses: path traversal (CWE-22) and improper handling of the NULL character (CWE-158). An attacker sends a crafted HTTP or HTTPS request to the device and can write a file to any location they choose. That makes it an easy path to full device takeover. An email gateway sits right at the boundary between the company and the internet, and it sees all of your email traffic.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to patch by October 4. A deadline that short shows how serious the threat is.
Affected versions
| Branch | Vulnerable versions | Fixed version |
|---|---|---|
| 8.0 | 8.0.0–8.0.1 | 8.0.2 or later |
| 7.6 | 7.6.0–7.6.6 | 7.6.7 or later |
| 7.4 | 7.4.0–7.4.8 | 7.4.9 or later |
| 7.2 | 7.2.0–7.2.9 | No fix available; migrate to 7.4.9 or later |
What to do now
- Update FortiMail to a fixed version. This is the only complete fix.
- If you can’t update right away, disable the IBE feature (Identity-Based Encryption) with the command in the vendor’s advisory.
- Limit access to the admin interface to trusted networks only. An email gateway’s management panel should never be reachable from the internet.
- Check for signs of compromise. Fortinet has published the attackers’ IP addresses and a list of files that were added or modified during the attacks. If the device was exposed to the internet before you patched it, review it for these indicators.
SecurHUB’s take
Email gateways, VPNs and firewalls are now favorite targets for attackers. They sit at the network edge, have broad privileges, and endpoint-level monitoring rarely covers them. If your organization falls under NIS2 or the amended National Cybersecurity System Act (KSC), you need to patch edge devices quickly. That is an explicit part of vulnerability management, and you will be held accountable for it.
Need help finding out whether your device has already been compromised? Contact us.
Sources: The Hacker News
