Fortinet and CISA warned that attackers are already exploiting a critical FortiMail flaw, putting organizations that use the email-security product at immediate risk. The bug, CVE-2026-104286, is a CVSS 9.8 path traversal and NULL-byte handling flaw that can be triggered with crafted HTTP or HTTPS requests to write arbitrary files and potentially achieve command or code execution. Affected versions are FortiMail 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1; fixes are planned for 7.4.9, 7.6.7, and 8.0.2.
Why it matters: This is urgent because the flaw is already being used in real attacks and customers do not yet have a patch. Organizations using FortiMail should immediately apply Fortinet’s mitigations, restrict management-interface exposure, disable IBE where possible, and check Fortinet’s indicators of compromise for signs of intrusion.
2026.10.02
98% relevant
This source directly updates the same FortiMail zero-day event, adding plain-language detail that the bug allows unauthenticated arbitrary file writes via crafted HTTP/HTTPS requests, can lead to code execution, and that CISA has added it to KEV with an October 4 deadline for federal agencies.
Ionut Arghire
2026.10.02
100% relevant
This article establishes a new tracked event centered on active exploitation of FortiMail zero-day CVE-2026-104286, Fortinet's mitigation guidance, and CISA's KEV addition before patches are available.
← Back to all stories