{"id":2080,"date":"2026-10-03T07:18:52","date_gmt":"2026-10-03T00:18:52","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-fortimail-zero-day-cve-2026-104286-dang-bi-khai-thac\/"},"modified":"2026-10-03T07:18:52","modified_gmt":"2026-10-03T00:18:52","slug":"fortimail-zero-day-cve-2026-104286-actively-exploited-2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-fortimail-zero-day-cve-2026-104286-dang-bi-khai-thac\/","title":{"rendered":"FortiMail Alert: CVE-2026-104286 Zero-Day Is Under Active Exploitation"},"content":{"rendered":"

C\u01a1 quan An ninh m\u1ea1ng v\u00e0 C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng M\u1ef9 (CISA) \u0111\u00e3 \u0111\u01b0a CVE-2026-104286<\/strong>, m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong c\u1ed5ng b\u1ea3o m\u1eadt email Fortinet FortiMail, v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities (KEV). Quy\u1ebft \u0111\u1ecbnh \u0111\u01b0\u1ee3c \u0111\u01b0a ra sau khi c\u00f3 b\u1eb1ng ch\u1ee9ng l\u1ed7i \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf. L\u1ed7 h\u1ed5ng c\u00f3 \u0111i\u1ec3m CVSS 9,8 v\u00e0 c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng ch\u01b0a x\u00e1c th\u1ef1c ghi t\u1ec7p t\u00f9y \u00fd l\u00ean h\u1ec7 th\u1ed1ng th\u00f4ng qua y\u00eau c\u1ea7u HTTP ho\u1eb7c HTTPS \u0111\u01b0\u1ee3c t\u1ea1o \u0111\u1eb7c bi\u1ec7t.<\/p>\n

\"C\u1ea3nh
CVE-2026-104286 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn giao di\u1ec7n qu\u1ea3n tr\u1ecb FortiMail v\u00e0 \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf. \u1ea2nh: The Hacker News<\/figcaption><\/figure>\n

CVE-2026-104286 nguy hi\u1ec3m nh\u01b0 th\u1ebf n\u00e0o?<\/h2>\n

Theo khuy\u1ebfn c\u00e1o FG-IR-26-175 c\u1ee7a Fortinet, v\u1ea5n \u0111\u1ec1 k\u1ebft h\u1ee3p hai \u0111i\u1ec3m y\u1ebfu: gi\u1edbi h\u1ea1n \u0111\u01b0\u1eddng d\u1eabn kh\u00f4ng \u0111\u00fang (path traversal, CWE-22) v\u00e0 x\u1eed l\u00fd k\u00fd t\u1ef1 NULL kh\u00f4ng an to\u00e0n (CWE-158). M\u1ed9t y\u00eau c\u1ea7u \u0111\u1ed9c h\u1ea1i c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua th\u01b0 m\u1ee5c \u0111\u01b0\u1ee3c gi\u1edbi h\u1ea1n v\u00e0 ghi t\u1ec7p l\u00ean thi\u1ebft b\u1ecb m\u00e0 kh\u00f4ng c\u1ea7n th\u00f4ng tin \u0111\u0103ng nh\u1eadp.<\/p>\n

Kh\u1ea3 n\u0103ng ghi t\u1ec7p t\u00f9y \u00fd \u0111\u1eb7c bi\u1ec7t nghi\u00eam tr\u1ecdng tr\u00ean thi\u1ebft b\u1ecb bi\u00ean nh\u01b0 c\u1ed5ng email. N\u1ebfu t\u1ec7p \u0111\u01b0\u1ee3c \u0111\u1eb7t v\u00e0o v\u1ecb tr\u00ed c\u00f3 th\u1ec3 th\u1ef1c thi ho\u1eb7c \u0111\u01b0\u1ee3c n\u1ea1p b\u1edfi d\u1ecbch v\u1ee5 h\u1ec7 th\u1ed1ng, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 t\u1ea1o b\u00e0n \u0111\u1ea1p \u0111\u1ec3 ch\u1ea1y m\u00e3, duy tr\u00ec quy\u1ec1n truy c\u1eadp, thay \u0111\u1ed5i c\u1ea5u h\u00ecnh ho\u1eb7c thu th\u1eadp d\u1eef li\u1ec7u. Fortinet v\u00e0 CISA \u0111\u1ec1u x\u00e1c nh\u1eadn ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c, nh\u01b0ng ch\u01b0a c\u00f4ng b\u1ed1 danh t\u00ednh t\u00e1c nh\u00e2n, th\u1eddi \u0111i\u1ec3m chi\u1ebfn d\u1ecbch b\u1eaft \u0111\u1ea7u hay t\u1ed5ng s\u1ed1 n\u1ea1n nh\u00e2n.<\/p>\n

C\u00e1c phi\u00ean b\u1ea3n FortiMail b\u1ecb \u1ea3nh h\u01b0\u1edfng<\/h2>\n

Ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 g\u1ed3m FortiMail 8.0.0\u20138.0.1, 7.6.0\u20137.6.6, 7.4.0\u20137.4.8 v\u00e0 7.2.0\u20137.2.9. Ng\u01b0\u1eddi d\u00f9ng nh\u00e1nh 7.2 \u0111\u01b0\u1ee3c khuy\u1ebfn ngh\u1ecb n\u00e2ng c\u1ea5p l\u00ean nh\u00e1nh 7.4 ho\u1eb7c m\u1edbi h\u01a1n. C\u00e1c b\u1ea3n 8.0.2, 7.6.7 v\u00e0 7.4.9 \u0111\u01b0\u1ee3c Fortinet li\u1ec7t k\u00ea l\u00e0 phi\u00ean b\u1ea3n ch\u1ee9a b\u1ea3n s\u1eeda l\u1ed7i khi ph\u00e1t h\u00e0nh.<\/p>\n

Do b\u1ea3n v\u00e1 cho m\u1ed9t s\u1ed1 nh\u00e1nh ch\u01b0a s\u1eb5n s\u00e0ng t\u1ea1i th\u1eddi \u0111i\u1ec3m c\u1ea3nh b\u00e1o, qu\u1ea3n tr\u1ecb vi\u00ean c\u1ea7n \u00e1p d\u1ee5ng bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u ngay. Fortinet khuy\u1ebfn ngh\u1ecb t\u1eaft t\u00ednh n\u0103ng IBE b\u1eb1ng l\u1ec7nh c\u1ea5u h\u00ecnh ch\u00ednh th\u1ee9c, \u0111\u1ed3ng th\u1eddi v\u00f4 hi\u1ec7u h\u00f3a truy c\u1eadp Internet v\u00e0o giao di\u1ec7n qu\u1ea3n tr\u1ecb ho\u1eb7c ch\u1ec9 cho ph\u00e9p truy c\u1eadp t\u1eeb c\u00e1c m\u1ea1ng ri\u00eang \u0111\u00e1ng tin c\u1eady.<\/p>\n

\"M\u00e1y
Thi\u1ebft b\u1ecb b\u1ea3o m\u1eadt email n\u1eb1m \u1edf bi\u00ean m\u1ea1ng c\u1ea7n \u0111\u01b0\u1ee3c c\u00f4 l\u1eadp giao di\u1ec7n qu\u1ea3n tr\u1ecb v\u00e0 gi\u00e1m s\u00e1t ch\u1eb7t ch\u1ebd. \u1ea2nh minh h\u1ecda th\u1ef1c t\u1ebf: Pexels<\/figcaption><\/figure>\n

D\u1ea5u hi\u1ec7u x\u00e2m nh\u1eadp c\u1ea7n r\u00e0 so\u00e1t<\/h2>\n

Fortinet c\u00f4ng b\u1ed1 hai \u0111\u1ecba ch\u1ec9 IP li\u00ean quan \u0111\u1ebfn ho\u1ea1t \u0111\u1ed9ng t\u1ea5n c\u00f4ng l\u00e0 79.141.169[.]187<\/code> v\u00e0 45.129.0[.]192<\/code>. C\u00e1c t\u1ec7p \u0111\u01b0\u1ee3c ghi th\u00eam g\u1ed3m \/data\/lib\/liblog.so<\/code>, \/data\/bin\/webconsole<\/code>, \/data\/bin\/mailservice<\/code> v\u00e0 \/data\/etc\/ld.so.preload<\/code>. C\u00e1c t\u1ec7p \/bin\/smit<\/code>, \/data\/etc\/httpd.conf<\/code> v\u00e0 \/data\/migadmin.tar.gz<\/code> c\u00f3 th\u1ec3 \u0111\u00e3 b\u1ecb s\u1eeda \u0111\u1ed5i.<\/p>\n

Nh\u1eadt k\u00fd \u0111\u00e1ng ch\u00fa \u00fd bao g\u1ed3m t\u00e1c v\u1ee5 cron b\u1ea5t th\u01b0\u1eddng li\u00ean quan \u0111\u1ebfn \/migadmin<\/code>, s\u1ef1 ki\u1ec7n \u0111\u0103ng xu\u1ea5t qu\u1ea3n tr\u1ecb vi\u00ean v\u1edbi giao di\u1ec7n kh\u00f4ng x\u00e1c \u0111\u1ecbnh, l\u1ed7i gi\u1ea3i m\u00e3 IBE do d\u1eef li\u1ec7u Base64 kh\u00f4ng h\u1ee3p l\u1ec7 v\u00e0 vi\u1ec7c t\u1ea1o t\u00e0i kho\u1ea3n l\u01b0u tr\u1eef t\u1eeb d\u00f2ng l\u1ec7nh. S\u1ef1 xu\u1ea5t hi\u1ec7n c\u1ee7a ch\u1ec9 d\u1ea5u kh\u00f4ng \u0111\u1ed3ng ngh\u0129a tuy\u1ec7t \u0111\u1ed1i thi\u1ebft b\u1ecb \u0111\u00e3 b\u1ecb chi\u1ebfm quy\u1ec1n, nh\u01b0ng c\u1ea7n k\u00edch ho\u1ea1t quy tr\u00ecnh \u0111i\u1ec1u tra v\u00e0 b\u1ea3o to\u00e0n b\u1eb1ng ch\u1ee9ng.<\/p>\n

V\u00ec sao ch\u1ec9 c\u00e0i b\u1ea3n v\u00e1 l\u00e0 ch\u01b0a \u0111\u1ee7?<\/h2>\n

Khi m\u1ed9t l\u1ed7 h\u1ed5ng \u0111\u00e3 b\u1ecb khai th\u00e1c, c\u1eadp nh\u1eadt ph\u1ea7n m\u1ec1m ch\u1ec9 ch\u1eb7n \u0111\u01b0\u1eddng t\u1ea5n c\u00f4ng trong t\u01b0\u01a1ng lai. B\u1ea3n v\u00e1 kh\u00f4ng t\u1ef1 \u0111\u1ed9ng x\u00f3a web shell, th\u01b0 vi\u1ec7n \u0111\u1ed9c h\u1ea1i, t\u00e0i kho\u1ea3n tr\u00e1i ph\u00e9p ho\u1eb7c thay \u0111\u1ed5i c\u1ea5u h\u00ecnh \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o tr\u01b0\u1edbc \u0111\u00f3. V\u00ec v\u1eady, t\u1ed5 ch\u1ee9c ph\u1ea3i xem \u0111\u00e2y v\u1eeba l\u00e0 nhi\u1ec7m v\u1ee5 qu\u1ea3n l\u00fd l\u1ed7 h\u1ed5ng v\u1eeba l\u00e0 m\u1ed9t t\u00ecnh hu\u1ed1ng \u1ee9ng ph\u00f3 s\u1ef1 c\u1ed1.<\/p>\n

CISA y\u00eau c\u1ea7u c\u00e1c c\u01a1 quan li\u00ean bang d\u00e2n s\u1ef1 M\u1ef9 ho\u00e0n th\u00e0nh ph\u00e2n t\u00edch ph\u00e1p ch\u1ee9ng v\u00e0 bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u tr\u01b0\u1edbc ng\u00e0y 4\/10\/2026. D\u00f9 y\u00eau c\u1ea7u n\u00e0y ch\u1ec9 \u00e1p d\u1ee5ng tr\u1ef1c ti\u1ebfp cho kh\u1ed1i li\u00ean bang M\u1ef9, m\u1ecdi t\u1ed5 ch\u1ee9c v\u1eadn h\u00e0nh FortiMail c\u00f4ng khai n\u00ean s\u1eed d\u1ee5ng m\u1ed1c th\u1eddi gian \u0111\u00f3 nh\u01b0 m\u1ed9t ch\u1ec9 b\u00e1o v\u1ec1 m\u1ee9c \u0111\u1ed9 kh\u1ea9n c\u1ea5p.<\/p>\n

Quy tr\u00ecnh \u1ee9ng ph\u00f3 \u0111\u01b0\u1ee3c khuy\u1ebfn ngh\u1ecb<\/h2>\n
    \n
  1. L\u1eadp danh s\u00e1ch to\u00e0n b\u1ed9 thi\u1ebft b\u1ecb FortiMail, x\u00e1c \u0111\u1ecbnh phi\u00ean b\u1ea3n v\u00e0 ki\u1ec3m tra giao di\u1ec7n qu\u1ea3n tr\u1ecb n\u00e0o \u0111ang ti\u1ebfp x\u00fac Internet.<\/li>\n
  2. H\u1ea1n ch\u1ebf giao di\u1ec7n qu\u1ea3n tr\u1ecb v\u1ec1 m\u1ea1ng ri\u00eang ho\u1eb7c danh s\u00e1ch \u0111\u1ecba ch\u1ec9 tin c\u1eady; t\u1eaft IBE theo h\u01b0\u1edbng d\u1eabn c\u1ee7a Fortinet n\u1ebfu ch\u01b0a th\u1ec3 c\u1eadp nh\u1eadt.<\/li>\n
  3. \u0110\u1ed1i chi\u1ebfu \u0111\u1ecba ch\u1ec9 IP, \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p, gi\u00e1 tr\u1ecb b\u0103m v\u00e0 s\u1ef1 ki\u1ec7n nh\u1eadt k\u00fd v\u1edbi b\u1ed9 ch\u1ec9 d\u1ea5u x\u00e2m nh\u1eadp ch\u00ednh th\u1ee9c.<\/li>\n
  4. N\u1ebfu ph\u00e1t hi\u1ec7n d\u1ea5u hi\u1ec7u b\u1ea5t th\u01b0\u1eddng, c\u00f4 l\u1eadp thi\u1ebft b\u1ecb, b\u1ea3o to\u00e0n nh\u1eadt k\u00fd v\u00e0 \u1ea3nh \u0111\u0129a, \u0111\u1ed3ng th\u1eddi r\u00e0 so\u00e1t h\u1ec7 th\u1ed1ng t\u1eebng k\u1ebft n\u1ed1i v\u1edbi FortiMail.<\/li>\n
  5. Thay \u0111\u1ed5i th\u00f4ng tin x\u00e1c th\u1ef1c, kh\u00f3a API, ch\u1ee9ng th\u01b0 v\u00e0 b\u00ed m\u1eadt c\u00f3 kh\u1ea3 n\u0103ng b\u1ecb l\u1ed9; d\u1ef1ng l\u1ea1i thi\u1ebft b\u1ecb t\u1eeb ngu\u1ed3n tin c\u1eady n\u1ebfu x\u00e1c nh\u1eadn x\u00e2m nh\u1eadp.<\/li>\n
  6. C\u00e0i phi\u00ean b\u1ea3n \u0111\u00e3 kh\u1eafc ph\u1ee5c ngay khi kh\u1ea3 d\u1ee5ng, sau \u0111\u00f3 ti\u1ebfp t\u1ee5c gi\u00e1m s\u00e1t l\u01b0u l\u01b0\u1ee3ng v\u00e0 ti\u1ebfn tr\u00ecnh b\u1ea5t th\u01b0\u1eddng.<\/li>\n<\/ol>\n

    B\u00e0i h\u1ecdc cho qu\u1ea3n tr\u1ecb h\u1ea1 t\u1ea7ng email<\/h2>\n

    C\u1ed5ng email th\u01b0\u1eddng x\u1eed l\u00fd d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m v\u00e0 n\u1eb1m t\u1ea1i ranh gi\u1edbi gi\u1eefa Internet v\u1edbi m\u1ea1ng n\u1ed9i b\u1ed9. Do \u0111\u00f3, m\u1ed9t l\u1ed7i ch\u01b0a x\u00e1c th\u1ef1c tr\u00ean giao di\u1ec7n qu\u1ea3n tr\u1ecb c\u00f3 th\u1ec3 t\u1ea1o ra h\u1eadu qu\u1ea3 v\u01b0\u1ee3t xa b\u1ea3n th\u00e2n thi\u1ebft b\u1ecb. T\u00e1ch bi\u1ec7t m\u1ea1ng qu\u1ea3n tr\u1ecb, h\u1ea1n ch\u1ebf quy\u1ec1n truy c\u1eadp, l\u01b0u nh\u1eadt k\u00fd t\u1eadp trung v\u00e0 chu\u1ea9n b\u1ecb quy tr\u00ecnh d\u1ef1ng l\u1ea1i thi\u1ebft b\u1ecb l\u00e0 nh\u1eefng ki\u1ec3m so\u00e1t c\u1ea7n c\u00f3 tr\u01b0\u1edbc khi s\u1ef1 c\u1ed1 x\u1ea3y ra.<\/p>\n

    Danh m\u1ee5c KEV gi\u00fap t\u1ed5 ch\u1ee9c \u01b0u ti\u00ean theo b\u1eb1ng ch\u1ee9ng khai th\u00e1c th\u1ef1c t\u1ebf thay v\u00ec ch\u1ec9 d\u1ef1a v\u00e0o \u0111i\u1ec3m CVSS. V\u1edbi CVE-2026-104286, th\u00f4ng \u0111i\u1ec7p quan tr\u1ecdng l\u00e0 ph\u1ea3i \u0111\u1ed3ng th\u1eddi gi\u1ea3m b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng, ki\u1ec3m tra kh\u1ea3 n\u0103ng \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp v\u00e0 chu\u1ea9n b\u1ecb c\u1eadp nh\u1eadt ngay khi b\u1ea3n v\u00e1 ph\u00f9 h\u1ee3p \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh.<\/p>\n

    VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb CISA, Fortinet, The Hacker News v\u00e0 BleepingComputer<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    C\u01a1 quan An ninh m\u1ea1ng v\u00e0 C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng M\u1ef9 (CISA) \u0111\u00e3 \u0111\u01b0a CVE-2026-104286, m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong c\u1ed5ng b\u1ea3o m\u1eadt email Fortinet FortiMail, v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities (KEV). Quy\u1ebft \u0111\u1ecbnh \u0111\u01b0\u1ee3c \u0111\u01b0a ra sau khi c\u00f3 b\u1eb1ng ch\u1ee9ng l\u1ed7i \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf. L\u1ed7 h\u1ed5ng c\u00f3 \u0111i\u1ec3m […]<\/p>\n","protected":false},"author":2,"featured_media":2078,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[167,906,907,188,808,93],"class_list":["post-2080","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-cisa-kev","tag-cve-2026-104286","tag-fortimail","tag-fortinet","tag-path-traversal","tag-zero-day"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2080","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2080"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2080\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2078"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2080"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2080"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2080"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}