FortiMail: patch out on the 2nd, advisory on the 7th, mitigation still on
On 1 October Fortinet published a 9.8 flaw in FortiMail, exploited and with no fixed release. The only mitigation available was to switch off IBE encryption: the channel your company uses to send confidential documents to people outside it. The fixed release notes are dated 2 October; the advisory did not say so until the 7th. If your trigger for removing the mitigation is the advisory, your clock runs five days behind. Inside: the branch table (including the branch that gets no patch), the indicators Fortinet did publish, what the public documentation does NOT answer, and a six-line record so a temporary mitigation does not last six months.
Microsoft 365
ES 
CAT 
EN