FortiMail and NetScaler Flaws Were Exploited Before Fixes Shipped

Two edge appliances were attacked in the first week of October before their owners had a fix to install: Fortinet's FortiMail mail gateway (CVE-2026-104286, rated 9.8) and Citrix's NetScaler ADC and Gateway (CVE-2026-88779, rated 8.7). CISA added both to its Known Exploited Vulnerabilities catalog, on Oct. 1 and Oct. 4.

The two bugs are unrelated in code. They share a shape that matters to anyone running either box: a vendor-published mitigation arrived with, or ahead of, the patch, and the mitigation depends on a setting the administrator has to find.

FortiMail: a file write through the identity-based encryption portal

Fortinet's advisory FG-IR-26-175, first published Oct. 1, describes a path traversal (CWE-22) combined with improper handling of NULL bytes (CWE-158) in the FortiMail GUI. An unauthenticated attacker can send crafted HTTP or HTTPS requests and write files to the underlying system. The CVSS 3.1 base score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the temporal score is 8.8.

Affected are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9. Fortinet says the flaw was found internally by Gwendal Guégniaud of its Product Security team.

Help Net Security reported on Oct. 2 that the fixed builds had not shipped. The advisory now lists 8.0.2, 7.6.7 and 7.4.9 as upgrade targets, tells 7.2 users to move to the 7.4 branch or later, and says FortiMail Cloud was fixed on 7.6.7 GA or 8.0.2 GA. It carries revisions dated Oct. 5 and Oct. 7.

The attack path runs through the identity-based encryption (IBE) service. Fortinet's workarounds are to switch IBE off, keep the webmail interface away from the internet, or block POST requests to /ibe containing ../ at a web application firewall. It lists two IP addresses as indicators of compromise and warns of a cron job running a shell command and an archive account added through the command line with a remote destination.

An arbitrary file write is not code execution by itself. Yordan Ganchev, a principal threat intelligence specialist at watchTowr, said of it: "This is trivial to exploit." Cybersecurity Dive reports watchTowr's view that an attacker who can place a file can run commands, which would expose stored mail and credentials. Fortinet has not said when exploitation began or how many systems were hit.

NetScaler: a bug labelled denial of service that kept being exploited

Citrix's advisory CTX697174 covers CVE-2026-88779, a memory buffer flaw that BleepingComputer reported on Oct. 4 with a CVSS 4.0 score of 8.7. Only appliances configured as a SAML service provider (add authentication samlAction) or SAML identity provider (add authentication samlIdPProfile) are exposed. Citrix classifies the impact as denial of service and says it has "not identified an impact on the integrity of customer data."

The evidence suggests more. Administrators reported on Friday, Oct. 2, that patched appliances, including builds at 14.1-73.37, were rebooting, with crashes in the nsaaad and Pitboss processes. One administrator found usernames containing shell commands that fetched a payload from 213.209.159[.]55 and ran it. The logs showed attempts, not confirmed execution. Researcher Kevin Beaumont reported patched honeypots crashing and a downloaded binary running on one, and called the activity "sprayed and prayed."

Beaumont also pointed to CVE-2025-6543, which Citrix first described as denial of service and which was later used for remote code execution. Help Net Security adds that researchers were still checking whether CVE-2026-88779 can be exploited for code execution, and that Bishop Fox and watchTowr are credited with reporting it. watchTowr reproduced the flaw and has not published technical details.

Fixed releases are 14.1-73.41 and 13.1-64.28, with FIPS builds at 14.1-73.41 FIPS and 13.1-37.282. Administrators who already upgraded for CVE-2026-88771 through CVE-2026-88778 must upgrade again if they use SAML. Citrix also added Global Deny Lists to block known malicious IPs, but says patching comes first.

The two cases side by side

	FortiMail	NetScaler
CVE	CVE-2026-104286	CVE-2026-88779
Score	9.8 (CVSS 3.1)	8.7 (CVSS 4.0)
Vendor advisory	FG-IR-26-175, Oct. 1	CTX697174, notice Oct. 2
CISA KEV deadline	Oct. 4	Oct. 7
Exposure condition	IBE service reachable	SAML SP or IdP configured

The scores are not comparable, because they use different versions of the scale. The NetScaler 8.7 reflects Citrix's judgement that the impact is availability, and Beaumont's honeypot finding is the reason to treat that judgement as provisional.

What the pattern means for operators

Both vendors put the exposure condition in the advisory, and both conditions are checkable in a minute: a CLI line for SAML on NetScaler, the IBE setting on FortiMail. An administrator who reads only the CVSS score and the product name will decide the box is in scope, but may not learn that a mitigation exists. FortiMail owners on 7.2 face a larger job than a patch: Fortinet's fix for them is a branch upgrade.

Upgrading to the build that fixed CVE-2026-88771 and CVE-2026-88772 did not protect a SAML appliance from CVE-2026-88779, which is why Citrix told those administrators to upgrade again.

The next fixed point is already set. Federal agencies had to remediate the NetScaler flaw by Oct. 7, and any organisation that has not should treat its appliance logs from Oct. 2 onward as suspect. Earlier patch-cycle coverage on this site covers CVE-2026-97229 in GitLab and a CERT-In advisory on payment APIs.