Critical FortiMail zero-day under active exploitation: what to check today if the email of your Mexico operation goes through Fortinet

On October 1, 2026 Fortinet confirmed a critical flaw in FortiMail that is already being used in real attacks. It lets an attacker write files on the appliance with no username or password, as BleepingComputer reported. In plain terms: someone on the internet can drop whatever they want inside the box that handles your email.

Your headquarters probably runs a different email filter. The question is what the Mexico site runs. In our experience, that is often a Fortinet box bought together with the firewall from a local integrator years ago, and nobody abroad has it on a list.

What FortiMail is and why this flaw matters

FortiMail is the appliance (or virtual machine) Fortinet sells to sit in front of a company email system and filter spam, malware and phishing. Think of it as a customs desk: every message is inspected there before it reaches anyone in Outlook.

That is why this one is serious. Writing files on that box can mean a backdoor, reading mail in transit or quietly forwarding the messages the attacker cares about. The Hacker News describes it as an unauthenticated arbitrary file write, the kind of bug that usually ends in full control of the device.

How to find out from abroad whether the Mexico site has one

Three quick checks you can run from your desk:

1. Ask the local IT contact or provider in writing: do we have a FortiMail or any Fortinet antispam? Ask for the exact version.
2. Look at the MX records of the Mexican domain. They say where its email is delivered. If they point to a local appliance or a Fortinet service instead of Microsoft or Google, there is a box in the middle.
3. Check the invoices from the Mexican integrator. FortiMail often ships bundled with the FortiGate firewall.

If a local provider manages it, ask for the patch date in writing. It is a normal request, not an accusation.

What to patch and in what order

The Fortinet advisory, linked from the BleepingComputer article, lists the affected and fixed versions. We are not copying the table here because it changes; compare the exact version on your appliance against it.

Step	What to do	Why
1	Write down the exact version from the status screen	To know whether you are on the list
2	Back up the configuration	If the patch fails, you are back in minutes
3	Apply the fixed version from the advisory	Closes the door
4	Send a test email in and out	A badly restarted filter stops all mail

Do it outside Mexico business hours if you can, but do not wait for next month’s maintenance window. Time zones help: a 7 am patch run from Europe lands at 11 pm the night before in Mexico City, while the office is empty.

Signs someone already got in

Patching closes the door. It does not evict whoever already walked through. Check:

• New or modified files on the appliance in recent weeks, especially in system folders. If nobody knows how to check that on FortiMail, have the provider do it with you on a call.
• Forwarding rules nobody created, such as the accountant’s mailbox now copying everything to a free webmail address.
• Admin accounts you do not recognize, or created recently.
• Admin console logins from addresses that are neither the Mexico office nor the provider.

If you cannot patch today

It happens: the local provider does not answer, it is month-end close, nobody wants to touch email on a Thursday. Meanwhile:

• Take the admin interface off the internet. Access only through VPN or from the local network.
• Restrict admin access to the IP addresses of the Mexico office, your HQ and the provider.
• Turn on two-factor for admin accounts if it is not on yet.
• Ship the logs somewhere outside the appliance.

Same logic we applied with the Zyxel and Veeam flaws: a perimeter box with its console open to the internet will be hit by the next bug too.

Let’s talk

And in your Mexico operation?

If there is a FortiMail in Mexico and nobody has touched it since install, now is the time. At ProcessBi the support plan includes review and patching of Fortinet perimeter devices, with same-day remote attention and hands on site anywhere in Mexico when needed, reporting back to you in English.

Book your free assessment — we reply the same business day.