Critical Fortinet FortiMail Zero-Day: CVE-2026-104286 Enables Unauthenticated Arbitrary File Writes
In October 2026, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation targeting Fortinet FortiMail email security gateways. This CVSS 9.8 vulnerability arises from the intersection of improper pathname limitation (CWE-22) and improper neutralization of null bytes (CWE-158) within the web management interface. Unauthenticated attackers can leverage crafted HTTP requests containing path traversal sequences and null bytes to bypass directory restrictions, allowing arbitrary file writes outside the intended web root. This flaw enables remote code execution (RCE) through webshell deployment, potential credential theft from mailboxes, and subsequent lateral movement within corporate networks.
GitLab Critical Path Traversal Vulnerability CVE-2025-13761 Enables RCE
A critical path traversal vulnerability, identified as CVE-2025-13761, has been discovered in the GitLab API, specifically within the Commits API. Attacking via a single HTTP request, threat actors can bypass file system restrictions to perform arbitrary file reads. This vulnerability allows for the unauthorized extraction of sensitive data, including /etc/passwd, SSH keys, and application secrets, which facilitates privilege escalation to Remote Code Execution (RCE). With a CVSS score of 10.0, the flaw is currently subject to active exploitation and widespread automated scanning. Immediate upgrade to GitLab version 19.3.2 or later is required to prevent full server compromise.