FortiMail CVE-2026-104286 and 3 Fortinet/PAN-OS CVEs Exploited

I was going through CISA KEV entries from late Sep. to mid-Oct. 2026 and found 4 vulnerabilities in firewalls and mail appliances from two major vendors added in quick succession: 3 from Fortinet and 1 from Palo Alto Networks. I put them together in one post, ordered by their KEV addition dates, because those of us managing network edge devices often handle several vendors at once, and these devices sit on the front line, where a compromise can cause far more damage than on an ordinary web server.

Overview of the 4 vulnerabilities

All KEV dates come from CISA's catalog, and CISA lists ransomware use as "Unknown" for all 4 vulnerabilities.

Fortinet FortiOS: heap overflow and CLI path traversal

CVE-2025-25249 (FG-IR-25-084) is a heap buffer overflow in the cw_acd daemon in FortiOS and FortiSwitchManager. An unauthenticated attacker can send a specially crafted request to execute code or commands. Fortinet says ASLR and PIE make exploitation harder but do not prevent it. The advisory was published on 13 Jan. 2026, while CISA only added it to KEV on 9 Sep.

There are two discrepancies in the information. First, the advisory page I read (last updated 23 Feb. 2026) says "Known Exploited: No," which predates CISA's KEV addition, so do not use that page to conclude that exploitation has not occurred. Second, CVSS scores differ by source: Fortinet's advisory (and the Fortinet entry in NVD) gives a base score of 8.1 and a temporal score of 7.4, while the CVE record at cve.org stores a vector that already includes temporal metrics, so it shows only 7.4; NVD gives its own score of 9.8 (I did not check which vector NVD uses). I use the vendor's 8.1 in the table above, and the affected-version list in the CVE record is narrower than the description in that same record, so I follow Fortinet's advisory table.

Until you can update, Fortinet recommends removing the fabric service from allowaccess on each interface, retaining only the services still needed, or blocking CAPWAP-CONTROL (UDP 5246 through 5249) on interfaces with fabric enabled, using a local-in policy that allows only trusted CAPWAP devices.

# FortiOS CLI ดูรุ่นกับบริการที่เปิดบนแต่ละ interface
get system status
show system interface

# ตัวอย่างเอา fabric ออกจาก interface ฝั่ง WAN (ชื่อ wan1 เป็นตัวอย่าง)
# allowaccess ใส่ทับทั้งรายการ ต้องใส่บริการที่ยังใช้อยู่ครบ ไม่งั้นตัดตัวเองออกจากอุปกรณ์
config system interface
    edit "wan1"
        set allowaccess ping https
    next
end

CVE-2025-61624 (FG-IR-26-122) is a path traversal vulnerability in the CLI command interpreter in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Someone with an admin profile granting read-write privileges or higher can pass arguments to existing commands to write or delete files. The vendor rates it as medium severity. The advisory was published on 14 Apr. 2026 and reports exploitation in the wild, while the KEV addition was on 16 Oct. In this table, I include only the rows for which the advisory provides a remediation path. Versions without a patch must migrate to a fixed release.

Fortinet provides no configuration workaround but lists a virtual patch named FG-VD-59270.0day in FMWP database 25.120. I treat that as an additional layer, though; the software still needs updating. Since administrator access is required first, the actual risk depends on whether administrator accounts have been compromised or the management interface is exposed to the internet.

FortiMail: no login required and the highest score

CVE-2026-104286 (FG-IR-26-175) combines path traversal with a NULL byte. An unauthenticated attacker can send a crafted HTTP or HTTPS request to write files to the FortiMail system. CVSSv3 is 9.8 (temporal 8.8). Fortinet says it discovered the issue internally and has received reports of exploitation in the wild. The advisory was published and the vulnerability added to KEV on the same day, 1 Oct.

The advisory gives 3 temporary workaround options: disable the IBE service in the GUI (Encryption, IBE, IBE Service), restrict webmail access to trusted private networks, or, if a WAF sits in front of FortiMail, block POST requests to /ibe containing ../.

Palo Alto PAN-OS: management interface

CVE-2026-0322 is a code injection vulnerability (CWE-94) in the PAN-OS management interface. An attacker who can log in and reach the management interface over the network can execute code as root on the firewall. It affects PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are unaffected. Palo Alto assigns CVSS 4.0 scores of 8.6 (network path) and 8.5 (adjacent path), rates the urgency as Highest, and reports "very limited" exploitation. The advisory was published on 14 Oct. 2026, the same day it was added to KEV.

The advisory also lists hotfix releases for some minor branches (such as 11.2.13-h3); check Palo Alto's page for the branch you run. There is no workaround, according to the vendor. Threat ID 510046 and 510047 provide only partial protection and also require SSL Decryption to be enabled. Restricting management interface access to trusted internal IPs or access through a jump host can reduce the risk.

What to check first, and how to check for compromise

1. Management interfaces Check whether FortiGate and FortiMail HTTPS/SSH and the PAN-OS management interface are reachable from the internet. If they are, block access or restrict source IPs before doing anything else.
2. fabric and IBE Check allowaccess on WAN interfaces and the FortiMail IBE service status.
3. Versions Compare against the tables above, then update in this order: FortiMail, PAN-OS, FortiOS.
4. Evidence Search for the vendor indicators listed below.

# PAN-OS CLI ดูรุ่นที่ใช้อยู่
show system info | match sw-version
# จำกัดผู้เข้า management interface ที่ GUI: Device > Setup > Interfaces > Management > Permitted IP Addresses

For vendor-published indicators, the FortiMail advisory lists IPs 79.141.169[.]187 and 45.129.0[.]192 (defanged here; the advisory page has formatting problems, so double-check the numbers against the original before searching), cron entries running /bin/sh -c under /migadmin, admin logout events, and CLI commands adding an archive account named archive234 that sends to an external destination under the /uploads directory. IBE logs will show BufferException with the message "Invalid Base64 Encoding." Palo Alto lists 3 associated IPs: 66.42.72.14, 208.83.239.114 and 149.248.47.234. For the two FortiOS vulnerabilities, I found no vendor-published indicators.

# ค้นใน log ที่ export ออกมาไว้ในเครื่องวิเคราะห์ (พาธเป็นตัวอย่าง)
grep -E '79\.141\.169\.187|45\.129\.0\.192|archive234' /srv/logs/fortimail/*.log
grep -E '66\.42\.72\.14|208\.83\.239\.114|149\.248\.47\.234' /srv/logs/pan-mgmt/*.log

Finding none of the listed IPs does not mean you are safe. These indicators cover only the incidents the vendors observed.

My own order would be FortiMail first, because it requires no login and scores 9.8, followed by PAN-OS because it has no workaround, then FortiOS, checking fabric on WAN interfaces first. I would update all of them outside the maintenance window if their management interfaces are exposed to the internet. Devices whose management interfaces are reachable only internally may be able to wait for the regular window, but not for long, depending on the risk each organization accepts.

P.S. Several rows above say "Migrate to a fixed release," such as FortiOS 6.4 (both vulnerabilities) and FortiOS 7.2 and 7.0 for CVE-2025-61624. That means Fortinet is not releasing patches for those branches. If you are still on one of them, plan the migration before time pressure forces the issue.

Sources: Fortinet PSIRT FG-IR-26-175 (https://fortiguard.fortinet.com/psirt/FG-IR-26-175), FG-IR-25-084 (https://fortiguard.fortinet.com/psirt/FG-IR-25-084), FG-IR-26-122 (https://fortiguard.fortinet.com/psirt/FG-IR-26-122), Palo Alto Networks CVE-2026-0322 (https://security.paloaltonetworks.com/CVE-2026-0322), the CVE record for each vulnerability (https://www.cve.org/CVERecord?id=CVE-2026-104286), CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Information current as of 5 Nov. 2026. If Fortinet releases FortiMail 7.2.10 or publishes more indicators, I will come back and update this post.