Cisco Secure Email Gateway and FortiMail: two email gateways with zero-days exploited in October

Published on October 15, 2026 · The mitza.es team

October 2026 has brought two critical zero-days in email security gateways, the devices that filter email before it reaches your users. Fortinet confirmed on October 1 the exploitation of CVE-2026-104286 in FortiMail, and Cisco warned in the middle of the month, with a CISA notice on October 14, about the exploitation of CVE-2026-76519 in Secure Email Gateway. Both have a CVSS score of 9.8, require no authentication and appear in CISA's catalog of known exploited vulnerabilities.

Cisco Secure Email Gateway: CVE-2026-76519

It is a relative path traversal flaw in the Advanced Malware Protection feature. An unauthenticated remote attacker can send an email with a malicious attachment through the affected device, write arbitrary files and run commands with root privileges. It affects both physical and virtual appliances, but only when two conditions are met at the same time: File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is older than version 25.3.0.5525.

• Fix: update Content Scanner Tools to 25.3.0.5525 or later. Cisco says there is no alternative mitigation and, according to several analyses, the update does not require a full system upgrade or a reboot.
• How to check: the contentscannerstatus command shows the installed version and contentscannerupdate forces the update if automatic updates are turned off.
• Exploitation: Cisco became aware of it in October. It has not said how many devices were affected or what the attackers did; one of the sources reports that it detected malicious activity on some Secure Email Cloud devices and contacted its customers directly. CISA gave federal agencies until October 17.

It is the second zero-day in this product in two months: the September one, CVE-2026-76461, was an SQL injection in email analysis that Cisco disclosed on September 14. Because the attackers operate with root privileges, a clean local scan is not enough to rule out that a device is already compromised.

Fortinet FortiMail: CVE-2026-104286

It combines a path traversal with the improper handling of a null character in the identity-based encryption (IBE) service, on the /ibe endpoint. An unauthenticated attacker can write arbitrary files to the system using crafted HTTP or HTTPS requests. Fortinet disclosed it on October 1 (advisory FG-IR-26-175) and CISA added it to its catalog the same day, with a deadline of October 4.

• Affected versions: 7.2.0 to 7.2.9, 7.4.0 to 7.4.8, 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1.
• Patch: in the initial advisory the fixed versions, 8.0.2, 7.6.7 and 7.4.9, were planned but not yet released, and those on the 7.2 branch were advised to move to 7.4 or later. An alert from Singapore's agency dated October 6 says Fortinet has already released updates without specifying versions, so check the current status in advisory FG-IR-26-175.
• Mitigation in the meantime: disable IBE from the command line (config system encryption ibe, set status disable, end) and block internet access to the administration interface or limit it to a trusted private network.
• Check whether an attack has already happened: Fortinet has published files, IP addresses and log entries associated with the attacks, but it has not said when they started, how many systems were affected or who is behind them.

Why they matter even if you run a small business

An email gateway is exposed to the internet, processes all your email and usually holds very high privileges inside the network. If it falls, the attacker doesn't just see your email: they gain a foothold inside your infrastructure. It is the same perimeter-device pattern we already saw with the Citrix NetScaler zero-days. If your email lives in Microsoft 365 or Google Workspace with no device of your own in front of it, these two flaws don't affect you directly; they do affect you if your company, your accountant or your IT provider runs one of these gateways.

What to do today

• Find out whether your company or your provider uses Cisco Secure Email Gateway or FortiMail; if you don't know which devices you have exposed to the internet, that is the first step.
• On Cisco, check the Content Scanner Tools version and update to 25.3.0.5525 or later. If you suspect the device was already exposed, treat it as potentially compromised and keep the logs before rebuilding it.
• On FortiMail, apply the IBE mitigation and the administration access restriction, review Fortinet's indicators of compromise and install the fixed version as soon as it is available for your branch.
• Don't leave administration interfaces open to the internet on any perimeter device.

This same week Microsoft also released its October bulletin with over 1,400 vulnerabilities, so if you don't have anyone keeping track of the inventory and the updates, our IT maintenance service includes that review, and an audit tells you which devices you have exposed and which version they are on.