Libala le-FortiMail Lelisetjentiswa Ngubagebengu: Umkhondvo Locace Kakhulu yi-Akhawunti Yekugcina Ema-imeyili Lekhombe Kusevha Yemhlaseli

Mhla ti-1 Imphala 2026 i-Fortinet yashicilela secwayiso ngelibala ku-FortiMail, sango sekuvikela ema-imeyili letinkampani letinyenti letibeka embikwemabhokisi awo ema-imeyili kuze kuhlolwe ema-imeyili langenako naphumako. Leli bala, CVE-2026-104286, likalwe nga-9.8 kuka-10, lingasetjentiswa ngumhlaseli longenayo i-akhawunti futsi longenalo liphasiwedi, futsi i-Fortinet itsi selivele lisetjentiswa ngubagebengu. Ngalo lelo langa, Ligunya Lavelonkhe Lekuvikeleka Kwe-inthanethi laseSawudi Arabhiya (NCA) lakhipha secwayiso 2026-7895 lesisezingeni Lelibucayi, futsi I-ejensi Yekuvikeleka Kwe-inthanethi Nengcalasizinda yaseMelika (CISA) yalengeta kuhlu layo lwemabala latiwako lasetjentisiwe.

Kungani leli bala libalulekile kubaphatsi ngaphambi kwe-IT

Liviki leliphelile sabhala ngelibala lelasetjentiswa kumphatsi wemanethiwekhi emagatja a-Cisco kanye nembuto yekutsi ngubani lofaka emaphetjhi etinhlelweni letiphatsiwe enkampanini yakho. Leli lihlukile ngendlela lebalulekile kubaphatsi ngaphambi kwe-IT: etimpawini tekungenelelwa leti-Fortinet itishicilele kukhona umugca werekhodi lokhombisa kutsi umhlaseli wengeta i-akhawunti yekugcina ema-imeyili lenendzawo leya kuyo lekusevha yangaphandle. Lapha ingoti ayigcini emshinini. Ifika kuma-imeyili enkampani ngekwawo.

Loko i-Fortinet lekushicilele

• Umkhicito: FortiMail, sango sekuvikela ema-imeyili se-Fortinet.
• Libala: butsakatsaka be-path traversal lobuhlangene nekuphatfwa lokungakalungi kwema-byte e-NULL ezicelweni, lokuvumela sicelo se-HTTP nobe se-HTTPS lesentiwe ngebucili kutsi sibhale emafayela ohlelweni lwemshini ngekwawo. I-Fortinet ikala umtselela njengekuchutjwa kwekhodi nobe imiyalo lengakavunywa.
• Simo lesidzingekako kucala: akukho. Umhlaseli lokhashane longakacinisekiswa, onemaphuzu e-CVSS a-9.8 kuka-10.
• Simo: lisetjentiswa ngubagebengu ngekusho kwe-Fortinet, futsi latfolwa ngekhatsi lithimba layo lekuvikela.
• Kulungiswa: ngesikhatsi secwayiso siphuma bekungakabi khona tibuyeketo, futsi i-SecurityWeek yabika mhla ti-2 Imphala kutsi kulungiswa kutawufika etingucukweni letitako ngaphandle kwelusuku lwekukhishwa. Emanothi ekukhishwa e-Fortinet abese abeka inguculo 7.6.7 ngamhla ti-2 Imphala kantsi tinguculo 7.4.9 na 8.0.2 ngamhla ti-3 Imphala, futsi mhla ti-5 Imphala i-Fortinet yabuyeketa sigaba sesisombululo secwayiso. Tinguculo letilungisiwe tikulelithebula lelingentasi.
• Secwayiso sendzawo: secwayiso 2026-7895 Seligunya Lavelonkhe Lekuvikeleka Kwe-inthanethi, sangamhla ti-1 Imphala 2026, ezingeni Lelibucayi, lesincoma kutsi imikhicito letsintsekile ibuyeketwe.
• Lilanga lekugcina eMelika: i-CISA yanika ema-ejensi ahulumende waseMelika kuze kube mhla ti-4 Imphala, emalanga lamatsatfu, futsi yafaka leli bala ngaphansi kwetidzingo tayo tekuhlolwa kwebufakazi. Leli libala lesishiyagalombili le-Fortinet le-ejensi selilengetile kuhlu lwayo kusukela ekucaleni kwa-2026.

Tinguculo letitsintsekile naletilungisiwe, ngekwesecwayiso:

Naka umugca wekugcina: ligatja 7.2 alitfoli kulungiswa ngekhatsi kwaleligatja. Lidzinga kutfutfela kulelinye ligatja, lokudzinga kuhlela kodvwa lokungeke kulindze.

Kungani sango se-imeyili sibaluleke kangaka

Sango se-imeyili simi emkhatsini we-inthanethi nemabhokisi ema-imeyili eticishamtsetfo takho, ngako-ke yonkhe imilayeto lengenako nalephumako idlula kuso: ema-quotation, ema-invoyisi ebaphakeli, tivumelwano, kubhalelana nemabhange, kanye netincwadzi tekucela kushintja imininingwane yasebhange. Ngiko loko lokwenta sibe nemandla lamakhulu ngetulu kwema-imeyili. Luhlelo loluhlola, lolubeka ekhweni, lolubetsela ngemfihlo nalolugcina imilayeto.

Indlela lesetjentiswa ngulelibala ingeyesici se-IBE, kubetsela ngemfihlo lokusekelwe kubunikati, i-FortiMail lesisebentisa kutfumela imilayeto lebetselwe ngemfihlo labemukeli labavula ngayo nge-portal yewebhu. Etinhlelweni letinyenti leyo portal iyafinyeleleka nge-inthanethi kuze labemukeli labangaphandle kwenkampani bakhone kuyisebentisa.

Umkhondvo lithimba lakho lekufanele liwufune: i-akhawunti yekugcina lekute lobekayakhile

Kanye nesecwayiso, i-Fortinet yashicilela timphawu tekungenelelwa. Tifaka ekhatsi emakheli e-IP lamabili, 79.141.169.187 na 45.129.0.192, kanye nemugca werekhodi yetehlakalo tesistimu lokhombisa kwengetwa kwe-akhawunti yekugcina lebitwa ngekutsi archive234, lenesevha lekhashane njengendzawo leya kuyo: lona lelikheli, 79.141.169.187, ku-directory lebitwa ngekutsi /uploads. Lona lomugca ukhombisa kutsi lolushintjo lwentiwa ngaphansi kwelibito lemsebenti admin, kusukela emugceni wemiyalo.

Kuze uvisisise kutsi lomugca usho kutsini: sici sekugcina se-FortiMail sigcina imilayeto legciniwe kuma-akhawunti ekugcina, futsi yonkhe i-akhawunti inendzawo leya kuyo. Ingaba yasekhaya, kudiski yemshini nobe kusevha yekugcina yemanethiwekhi, nobe ikhashane, kusevha lomshini lohlangana nayo nge-FTP nobe nge-SFTP. Kutsi nguyiphi imilayeto legcinwako kuncunywa yimigomo yekugcina leyehlukile. Ngako-ke i-akhawunti yekugcina lekhombe kusevha yemhlaseli iba, nje nangabe umgomo wekugcina uhlanganiswa nayo, yindlela yekukopisha imilayeto iyiswe ngaphandle kwenkampani. Secwayiso asisho kutsi ngabe kukhona yini ema-imeyili lakopishwa ngempela etimeni letatfolakala.

Loko lokufanele ukucele kulithimba lakho le-IT nobe kumhlinzeki wakho wetinsita:

• Kubuketa yonkhe i-akhawunti yekugcina nayo yonkhe imigomo yekugcina emshinini, nekubuta ngayo yonkhe indzawo lekhashane lekute muntfu enkampanini loyatiko.
• Kuphenya emarekhodini ngekufuna lamakheli lamabili lashicilelwe, kanye ne-akhawunti lebitwa ngekutsi archive234 nobe nome nguyiphi i-akhawunti yekugcina lensha longaticiwa umakhi wayo.
• Kubuketa ema-akhawunti ebaphatsi emshinini kanye nalo lonkhe lushintjo lwekuhlelwa lekute lolukhona kulichaza.
• Kugcina ikhophi yemarekhodi nekuhlelwa kwemshini ngaphambi kwekufaka iphetjhi. Kuhlelwa ngalokuvamile kuyasala ngemuva kwekubuyeketa, ngako-ke i-akhawunti leyengetwa ngaphambili ihlala ikhona kuze kube kutsi lotsite uyayisusa. Iphetjhi ivala umnyango. Ayikutjeli kutsi ngubani lowangena ngawo.

Nangabe ungeke ukhone kufaka iphetjhi namuhla ebusuku

I-Fortinet ibala indlela yesikhashana lenetinketfo letintsatfu:

• Cima sici se-IBE ku-GUI (Encryption, bese kuba yi-IBE, bese ucima i-IBE Service) nobe kusukela emugceni wemiyalo.
• Nobe uvimbe kufinyelela kwe-inthanethi ku-interface ye-webmail ye-FortiMail, nobe ukukhawulele kunethiwekhi yangasese letsembekile.
• Nobe, nangabe kukhona i-firewall yetinhlelo tewebhu embikwemshini, vimba ticelo te-POST leti-ya ku-/ibe letinalokutsi ../ .

Kucima i-IBE kumisa kutfunyelwa lokubetselwe ngemfihlo ngalesici, ngako-ke nangabe kukhona umnyango lowetsembele kuso, vumelana nawo ngendlela lenye yesikhashana. Indlela yesikhashana iyancipha kutsi ngubani longafinyelela kulelibala. Ayitfatsi indzawo yekubuyeketa, futsi ayisusi sidzingo sekuhlola loko lokwenteka ngaphambi kwayo.

Umonakalo wangempela ufika etimalini emaviki ngemuva

Kukopisha ema-imeyili akusiyo inhloso ngekwako. Nobe ngubani lofundza kubhalelana kwakho nebaphakeli uyafundza kutsi ngubani lotfumela ema-invoyisi, nini, ngaliphi lifomethi, kanye nekutsi nguyiphi i-oda yekutsenga lesalindzile inkhokhelo. Yile ncwadzi ngco lekudzingwa kukhwabanisa ngekuphambukisa ema-invoyisi: umlayeto lobukeka ngatsi uvela kumphakeli, ngekhatsi kwenkhulumiswano yangempela, lowucela kutsi inkhokhelo lelandzelako iye ku-akhawunti yasebhange lensha.

Kumisa loluhlobo lwekukhwabanisa akudzingi buchwepheshe. Kudzinga umtsetfo lithimba lakho letetimali lelitawulandzela kusukela namuhla:

• I-akhawunti yasebhange yemphakeli ayikaze ishintjwe ngenca ye-imeyili yodvwa, noma ingabukeka iyiciniso kangakanani.
• Cinisekisa ngelucingo kunombolo lesevele ikhona efayeleni lemphakeli, hhayi kunombolo lenikwe emlayetweni ngekwawo.
• Kushintjwa kwemniningwane yasebhange yemphakeli kudzinga kuvunywa ngumuntfu wesibili longasuye lowakufaka, futsi luhlelo lubhala kutsi ngubani lowakushintja futsi nini.
• Inkhokhelo yekucala leya ku-akhawunti yasebhange lensha ihlolwa ngekucophelela kwendlula letinye.

Sachaza kutsi ungayakha kanjani indlela yekushintja imininingwane yasebhange ohlelweni esihlokweni setfu lesikhuluma ngekukhokhelwa kwebaphakeli lokuhleliwe nekucatsaniswa kwetitatimende.

Nangabe kuvela kutsi imilayeto yakopishwa

Nangabe lithimba lakho litfola i-akhawunti yekugcina lengatiwa nobe bufakazi bekutsi imilayeto yakopishwa, kutsatse njengekwephulwa kwemniningwane, hhayi njengeliphutsa lekuhlela, ngobe i-imeyili ngalokuvamile itfwele imininingwane yemuntfu: emabito emakhasimende, tinombolo temakhalekhikhini nemakheli. Umhlahlandlela wetinchubo Weligunya Lemniningwane Nebuhlakani Lobentiwe laseSawudi (SDAIA) ngetehlakalo tekwephulwa kwemniningwane yemuntfu ufuna kutsi umlawuli atise ligunya lelifanele kungakapheli ema-awa langu-72 avile ngesehlakalo lesingalimata imininingwane nobe bantfu labangebayo, nobe sishayisane nemalungelo abo nobe tinzuzo tabo, futsi atise labanikati bemniningwane labatsintsekile ngaphandle kwekulibala lokungakafaneli nangabe silimata imininingwane yabo nobe sishayisana nemalungelo abo nobe tinzuzo tabo. Tjela nebaphakeli kanye nemakhasimende labo kubhalelana kwabo kwavezwa, ngobe imilayeto yekukhwabanisa letfwele libito lenkampani yakho ingafika kubo.

Umbono we-Origami

Sakha tinhlelo temabhizinisi. Asitsengisi futsi asiphatsi imishini ye-imeyili. Kodvwa yonkhe luhlelo lesilwakhako litfumela ema-imeyili: ema-invoyisi, kucinisekiswa kwema-oda, titatimende te-akhawunti. Ngekwembono wetfu, emandla ekukopisha ema-imeyili enkampani afanele kuhlolwa ngendlela lefanako nekufinyelela ohlelweni lwetekubalwa kwetimali, ngobe i-invoyisi kanye nesicelo sekushintja imininingwane yasebhange kokubili kuhamba nge-imeyili ngaphambi kwekufika ohlelweni.

Leli bala silifundza ngetindlela letimbili kubanikati bemabhizinisi baseSawudi. Kwekucala, imishini yekuvikela ngekwayo seyiphendvuke inhloso lephindzaphindzwako, ngako-ke umshini lowawutsenga kuvikela ema-imeyili akho udzinga umuntfu lolandzela tecwayiso tawo futsi awubuyekete njengalo lonkhe lolunye luhlelo. Kwesibili, imphendvulo lencono kakhulu ekubhalelaneni lokwebiwe akusiyo yetebuchwepheshe kuphela: umtsetfo wekucinisekisa ngelucingo etimalini uyakuhlula kukhwabanisa lokwakhelwe kuma-imeyili lebiwe, noma kungeniswa kungakaze kutfolwe.

Lokubalulekile

• Nangabe inkampani yakho isebentisa i-FortiMail, tfola inguculo yayo namuhla ubuyekete ku-8.0.2, 7.6.7, 7.4.9 nobe lensha kunaleyo, futsi utfutse ligatja 7.2 uliyise ku-7.4 nobe lelisha kunalo.
• Kuze kube kubuyeketa: cima i-IBE, nobe uvimbe kufinyelela kwe-inthanethi ku-interface ye-webmail.
• Buketa ema-akhawunti nemigomo yekugcina, ufune lamakheli lamabili lashicilelwe, futsi ugcine emarekhodi ngaphambi kwekufaka iphetjhi.
• Tjela tetimali namuhla: akukho kushintjwa kwe-akhawunti yasebhange yemphakeli ngaphandle kwekucinisekisa ngelucingo kunombolo letiwako kanye nemuntfu wesibili lovumako.
• Nangabe imilayeto lekopishiwe beyinemininingwane yemuntfu futsi kwephulwa kungalimata bantfu labatsintsekile nobe kushayisane nemalungelo abo nobe tinzuzo tabo, sikhatsi sekugcina sekwatisa ligunya lelifanele ngema-awa langu-72 kusukela ekuveni ngesehlakalo.

Imitfombo

• Fortinet: secwayiso FG-IR-26-175 nge-CVE-2026-104286 (sashicilelwa mhla ti-1 Imphala 2026, sabuyeketwa mhla ti-5 Imphala), umtfombo wetinguculo, indlela yesikhashana netimphawu tekungenelelwa
• Ligunya Lavelonkhe Lekuvikeleka Kwe-inthanethi (NCA): secwayiso se-Fortinet 2026-7895 (ti-1 Imphala 2026)
• CISA: libala linye laziwako lelisetjentisiwe lengetwe kuhlu (ti-1 Imphala 2026), kanye nalolu hlu ngekwalo
• SecurityWeek: Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action (ti-2 Imphala 2026)
• Fortinet: Umhlahlandlela Wekuphatsa i-FortiMail, kuhlela ema-akhawunti ekugcina ema-imeyili
• Fortinet: emanothi ekukhishwa e-FortiMail ku-7.6.7, 7.4.9 na-8.0.2
• Ligunya Lemniningwane Nebuhlakani Lobentiwe laseSawudi (SDAIA): Umhlahlandlela Wetinchubo Wetehlakalo Tekwephulwa Kwemniningwane Yemuntfu