# Fortinet software security vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/fortinet-software-security-vulnerabilities
> Updated: 2026-10-02T08:53:13.000Z. Sources: 8. Developments: 2.

Security vulnerabilities have been identified in Fortinet software products. Initial reports highlighted critical flaws in FortiOS and FortiProxy, including CVE-2024-21762 and CVE-2024-23113, which were noted for being exploited in the wild.

Subsequently, a critical zero-day vulnerability, CVE-2026-104286, was discovered in Fortinet’s FortiMail email security appliances. This flaw allows unauthenticated attackers to write arbitrary files to the operating system via the Identity-Based Encryption GUI component. While Fortinet announced upcoming fixes, immediate mitigations such as disabling the affected feature or blocking management interface access were recommended.

## Timeline

### 2026-10-02: Fortinet FortiMail zero-day vulnerability actively exploited

A critical zero-day vulnerability (CVE-2026-104286) in Fortinet FortiMail is being actively exploited, allowing unauthenticated attackers to write arbitrary files to affected systems.

4 sources. https://clstr.news/cluster/fortinet-fortimail-zero-day-vulnerability-actively-exploited

### 2026-09-19: Fortinet and SolarWinds issue patches for critical security vulnerabilities

Fortinet and SolarWinds have issued patches for critical vulnerabilities, including an actively exploited FortiOS flaw and a high-severity remote code execution bug in SolarWinds Access Rights Manager.

4 sources. https://clstr.news/cluster/fortinet-and-solarwinds-issue-patches-for-critical-security-vulnerabilities

---
Cite as: Fortinet software security vulnerabilities. CLSTR, https://clstr.news/situations/fortinet-software-security-vulnerabilities