FortiMail Zero-Day Under Active Exploitation

Fortinet FortiMail has a path traversal flaw combined with improper neutralization of a NULL byte (CWE-22 and CWE-158). An unauthenticated attacker can send crafted HTTP or HTTPS requests that write arbitrary files on the underlying system. Successful exploitation can place attacker-controlled content on the appliance and may be used to alter its behavior or persist access. The issue affects Fortinet FortiMail; specific version ranges are not listed in the available data, and CVSS has not yet been scored. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-01, so exploitation in the wild is confirmed, while ransomware use and a public proof of concept are not known.

Do: Apply Fortinet's fixes or mitigations for CVE-2026-104286 immediately, in line with CISA BOD 26-04, and treat internet-exposed FortiMail as highest priority. If a vendor fix is unavailable, restrict HTTP/HTTPS management access or discontinue use. Review systems added to the KEV catalog on 2026-10-01 for unexpected file writes and follow CISA forensics triage requirements.