FortiMail (Product): news timeline & CVEs

Fortinet security advisory (AV26-989)

Canada's Cyber Centre warns FortiMail path-traversal CVE-2026-104286 is exploited in the wild and listed in CISA KEV.

On October 1, 2026, the Canadian Centre for Cyber Security issued advisory AV26-989 on FortiMail vulnerabilities. Affected versions are FortiMail 8.0 before 8.0.2, 7.6 before 7.6.7, and 7.4 before 7.4.9; 7.2 users are directed to upgrade to 7.4 or later. Fortinet says CVE-2026-104286, an improper pathname limitation, is exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog the same day.

Canadian Centre for Cyber SecurityOct 2, 11:37 UTC · 12h agoExploit / PoC in the wild 8 sources CVE-2026-104286

Fortinet sounds the alarm over actively exploited FortiMail zero-day

Fortinet says attackers are exploiting critical FortiMail zero-day CVE-2026-104286 to write files without authentication.

Fortinet warned that CVE-2026-104286, a critical FortiMail flaw scored CVSS 9.8, is being exploited in the wild. Unauthenticated attackers can send crafted HTTP or HTTPS requests that combine path traversal and improper null-character handling to write arbitrary files and potentially execute commands. Versions 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9 are affected, and fixes for several branches remain upcoming. CISA placed the flaw in its Known Exploited Vulnerabilities catalog, requiring US federal civilian agencies to triage and mitigate by October 4, while Fortinet urges disabling unused Identity Based Encryption and blocking internet access to the management interface.

The Register · Securityupdated Oct 2, 11:37 UTC · 12h agofirst Oct 2, 10:53 UTC · 13h agoExploit / PoC in the wild 8 sources CVE-2026-104286

Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)

Attackers are exploiting critical FortiMail zero-day CVE-2026-104286 before patches are available.

Fortinet warned that CVE-2026-104286, a critical FortiMail zero-day scored 9.8, is being exploited in the wild. An unauthenticated attacker can combine path traversal and null-byte handling flaws to write arbitrary files through crafted HTTP or HTTPS requests. Affected versions are 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9; fixes in 8.0.2, 7.6.7, and 7.4.9 were not yet available. CISA added the flaw to its KEV catalog the same day and set a US federal deadline of October 4, 2026. Fortinet advised disabling identity-based encryption or restricting the management interface and published attack indicators.

Help Net Securityupdated Oct 2, 11:37 UTC · 12h agofirst Oct 2, 08:50 UTC · 15h agoExploit / PoC in the wild 8 sources CVE-2026-104286

Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

Unpatched FortiMail zero-day CVE-2026-104286 is exploited in the wild and added to CISA KEV.

CISA and Fortinet warned that critical FortiMail zero-day CVE-2026-104286, scored CVSS 9.8, is being exploited in the wild and has no patch yet. The path-traversal and NULL-byte flaw lets attackers write arbitrary files through crafted HTTP or HTTPS requests and potentially execute code. Fortinet advises disabling IBE support or restricting the management interface, and CISA added the bug to the KEV catalog with a three-day federal deadline. Fixes are planned for FortiMail 7.4.9, 7.6.7, and 8.0.2, with no release date given.

SecurityWeekupdated Oct 2, 11:37 UTC · 12h agofirst Oct 2, 08:07 UTC · 16h agoExploit / PoC in the wild 8 sources CVE-2026-1042861

U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited Fortinet FortiMail path traversal CVE-2026-104286 (CVSS 9.8) to the KEV catalog.

The U.S. CISA added Fortinet FortiMail CVE-2026-104286, a CVSS 9.8 path traversal and NULL-byte handling flaw, to its Known Exploited Vulnerabilities catalog. An unauthenticated attacker can use crafted HTTP or HTTPS requests to bypass path checks and write arbitrary files on the system. Fortinet says the issue is exploited in the wild and affects FortiMail 7.2 through 8.0; fixed versions are still upcoming, and a workaround is to disable Identity-Based Encryption or restrict management-interface access. Federal civilian agencies must remediate by October 3, 2026 under BOD 22-01.

Security Affairsupdated Oct 2, 11:37 UTC · 12h agofirst Oct 2, 05:50 UTC · 18h agoExploit / PoC in the wild 8 sources CVE-2026-104286

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CISA added exploited FortiMail flaw CVE-2026-104286, a critical unauthenticated file-write bug, to the KEV catalog.

CISA added Fortinet FortiMail CVE-2026-104286, a CVSS 9.8 path-traversal and NULL-byte flaw, to the Known Exploited Vulnerabilities catalog after confirmed active exploitation. An unauthenticated attacker can write arbitrary files via crafted HTTP or HTTPS requests. Affected branches are FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and 7.2.0-7.2.9, with some fixes still upcoming. Until patches ship, Fortinet advises disabling IBE and restricting management access; federal agencies must mitigate by October 4, 2026.

The Hacker NewsOct 2, 05:49 UTC · 18h agoExploit / PoC in the wildCVE-2026-104286 CVE-2026-85102 CVE-2026-93616+5 CVEs2

Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers

Attackers are exploiting critical FortiMail path-traversal CVE-2026-104286 to write files and compromise email appliances.

Fortinet advisory FG-IR-26-175 discloses CVE-2026-104286, a CVSS 9.8 path-traversal flaw in FortiMail that lets unauthenticated attackers write arbitrary files through crafted HTTP or HTTPS requests. Fortinet says the bug is being exploited and that file writes could lead to code or command execution. Affected versions include 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9; fixes 8.0.2, 7.6.7, and 7.4.9 are identified, while 7.2 users are told to move to 7.4 or later. Until patches, Fortinet advises disabling Identity-Based Encryption or limiting management exposure, and published IOCs including suspicious files and IPs 79.141.169.187 and 45.129.0.192.

GBHackersupdated Oct 2, 11:37 UTC · 12h agofirst Oct 2, 05:14 UTC · 19h agoExploit / PoC in the wild 8 sources CVE-2026-104286

Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks

Attackers are exploiting critical FortiMail zero-day CVE-2026-104286 to write files without authentication.

Fortinet advisory FG-IR-26-175 says attackers are exploiting CVE-2026-104286, a critical FortiMail zero-day scored CVSS 9.8. Unauthenticated attackers can write files through crafted HTTP or HTTPS requests by combining path traversal (CWE-22) with improper NULL-byte handling (CWE-158). Affected releases span FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9, while fixes such as 8.0.2, 7.6.7, and 7.4.9 were still upcoming. Fortinet urges disabling IBE or restricting management access and lists added files, hashes, and IPs 79.141.169.187 and 45.129.0.192. This is separate from earlier CVE-2025-32756.

Cyber Security Newsupdated Oct 2, 11:37 UTC · 12h agofirst Oct 2, 02:19 UTC · 21h agoExploit / PoC in the wild 8 sources CVE-2026-104286 CVE-2025-32756

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Fortinet says critical FortiMail flaw CVE-2026-104286 is being exploited in zero-day attacks.

Fortinet warned that CVE-2026-104286, a critical FortiMail flaw scored CVSS 9.8, is under active zero-day exploitation. An unauthenticated path-traversal and null-byte bug lets attackers write arbitrary files via crafted HTTP or HTTPS requests to the management interface. It affects FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1, and patches for 7.4, 7.6, and 8.0 are still pending. CISA added the flaw to the KEV catalog with a federal mitigation deadline of October 4, 2026, and Fortinet published file hashes plus IPs 79.141.169.187 and 45.129.0.192.

BleepingComputerupdated Oct 2, 11:37 UTC · 12h agofirst Oct 1, 22:42 UTC · 1d agoExploit / PoC in the wild 8 sources CVE-2026-104286

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited Fortinet FortiMail path traversal CVE-2026-104286 to the KEV catalog.

CISA added CVE-2026-104286, a Fortinet FortiMail path traversal vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The alert points to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize KEV flaws on exposed assets and to check for compromise before patching. CISA encourages every organization to remediate cataloged vulnerabilities using a risk-based process.

CISA AdvisoriesOct 1, 12:00 UTC · 1d agoExploit / PoC in the wildCVE-2026-1042861· 1 read

FortiMail

Timeline10 articles

Related CVEsby mentions

Appears with