CISA Flags Critical FortiMail Zero-Day as Actively Exploited, Urges Immediate Mitigation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) placed a newly disclosed Fortinet FortiMail vulnerability into its Known Exploited Vulnerabilities (KEV) catalog on Thursday, signaling that threat actors are already leveraging the flaw in the wild.

The defect, identified as a zero‑day that permits unauthenticated attackers to write arbitrary files to the underlying system, could allow adversaries to install malicious code, alter email routing, or gain broader footholds within targeted networks. FortiMail, a widely deployed email security appliance, is used by enterprises and government agencies to filter spam, phishing, and malware, making the potential impact of the bug especially concerning.

CISA’s decision to add the issue to the KEV list follows multiple reports of active exploitation, which were first highlighted by The Hacker News. While the agency has not released a CVE identifier in this brief, the vulnerability’s severity is classified as critical, reflecting the ease with which it can be triggered without any credentials.

Fortinet has responded by issuing an advisory that recommends immediate installation of the latest firmware updates, which contain a patch that blocks the arbitrary file‑write path. The vendor also advises administrators to review configuration settings, enforce strict access controls, and monitor for suspicious file creation activity on the appliance.

Security experts note that the exploitation technique aligns with a broader trend of attackers targeting email infrastructure to bypass traditional defenses. By compromising a mail gateway, threat actors can insert malicious payloads directly into inbound or outbound messages, increasing the likelihood of successful phishing campaigns or data exfiltration.

Organizations that rely on FortiMail are urged to verify that their systems are running the patched version, apply any recommended hardening measures, and consult CISA’s guidance on KEV remediation. The agency continues to track exploitation activity and will update its alerts as additional information becomes available, underscoring the importance of rapid response to critical vulnerabilities in core security appliances.