Summary
CVE-2026-47575, a CVSS 9.3 zero-day in Fortinet FortiMail, is being actively exploited. The vulnerability allows unauthenticated remote code execution on FortiMail email security gateways. FortiMail is widely deployed as an enterprise email security appliance on the network perimeter. An emergency patch has been released and organizations should apply it immediately, auditing the appliance for indicators of compromise given that active exploitation predates the patch.
Timeline
| Date | Event |
|---|---|
| Oct 3, 2026 | CVE-2026-47575 in FortiMail confirmed exploited; CVSS 9.3; emergency patch released |
What Happened
FortiMail processes all inbound and outbound email for organizations that deploy it, giving it visibility into and control over the full email flow. Remote code execution in FortiMail provides an attacker with code execution in a position of significant network trust — the email gateway has established connections to internal mail servers, directory services, and network infrastructure. Organizations running vulnerable FortiMail versions during the exposure window should assume the appliance may have been compromised and conduct forensic review of the appliance and downstream systems.
Domain Intelligence
fortinet.com — 88.0
fortinet.com scores at 88.0 in the high-trust range. Fortinet is the vendor of the affected FortiMail product.