FortiMail's encryption portal let attackers write files without logging in

Attackers are exploiting CVE-2026-104286, a 9.8-rated flaw in FortiMail's encryption feature that lets them write files without logging in. Also: MI5's alert on China-funded research and a Danish university's identity system breach. Sources Fortinet PSIRT advisory FG-IR-26-175 (FortiMail path traversal) CISA Known Exploited Vulnerabilities Catalog The Hacker News: Critical FortiMail Zero-Day Flaw Exploited in Attacks GBHackers: Fortinet FortiMail Path Traversal Flaw Actively Exploited The Next Web: MI5 says over 100 UK academics worked on projects funded by China's spies DTU: Hackerangreb mod DTU, underretning om brud paa persondatasikkerheden Read the written version