Story · 8 sources · 8 articlesfirst Oct 1, 22:42 UTCupdated Oct 2, 11:37 UTC (12h ago)

FortiMail zero-day CVE-2026-104286 exploited in the wild; Canada's Cyber Centre adds advisory as patches remain pending

criticalExploit / PoCexploited in the wildimportance 88CVE-2026-104286 CVE-2025-32756

What's new: Since the previous summary, the Canadian Centre for Cyber Security published advisory AV26-989 (advisory dated October 1, 2026), independently confirming in-the-wild exploitation, stating that CISA added the flaw to the KEV catalog on October 1, 2026, and reinforcing upgrade guidance (8.0 to 8.0.2, 7.6 to 7.6.7, 7.4 to 7.4.9, 7.2 to 7.4 or later). No patch has been released for any branch, and…

Merged summary · glm-5.3 · rewritten as coverage arrives

Unauthenticated attackers are exploiting unpatched FortiMail zero-day CVE-2026-104286 (CVSS 9.8) to write arbitrary files; fixes are still unavailable, CISA added it to the KEV catalog on October 1, 2026, and sources disagree on the federal remediation…

Fortinet advisory FG-IR-26-175 says CVE-2026-104286, a critical FortiMail flaw scored CVSS 9.8, is under active zero-day exploitation; no threat actor has been named, and Cyber Security News said the issue is separate from earlier CVE-2025-32756. Unauthenticated attackers can write arbitrary files through crafted HTTP or HTTPS requests to the management interface by combining path traversal (CWE-22) with improper NULL-byte handling (CWE-158); GBHackers, SecurityWeek, and The Register report those writes could lead to code or command execution. Affected versions are FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1; identified fixes 7.4.9, 7.6.7, and 8.0.2 were still upcoming or not yet available, SecurityWeek said no release date was given, and both GBHackers and the Canadian Centre for Cyber Security direct 7.2 users to move to 7.4 or later. Until patches, Fortinet advises disabling Identity-Based Encryption—The Register specifies unused IBE—or restricting management access, including keeping the interface off the internet, and published indicators including ld.so.preload, webconsole, file hashes, and IPs 79.141.169.187 and 45.129.0.192. CISA added the flaw to the KEV catalog, with the Canadian Cyber Centre dating that addition October 1, 2026, but sources disagree on the federal deadline: BleepingComputer, Help Net Security, and The Register reported October 4, 2026, Security Affairs reported October 3, 2026 under BOD 22-01, and SecurityWeek described a three-day deadline without a calendar date.

CVE-2026-104286 is a CVSS 9.8 unauthenticated flaw in FortiMail disclosed in Fortinet advisory FG-IR-26-175 and confirmed exploited in the wild; no threat actor has been named.
The bug combines path traversal (CWE-22) with improper NULL-byte handling (CWE-158), allowing arbitrary file writes via crafted HTTP or HTTPS requests to the management interface, with potential code or command execution reported by…
Affected versions: FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1.
Fixes 7.4.9, 7.6.7, and 8.0.2 were still upcoming with no release date given; FortiMail 7.2 has no fix listed and users are directed to upgrade to 7.4 or later.
Workarounds until patch availability: disable Identity-Based Encryption (The Register specifies unused IBE) or restrict management-interface access, including keeping it off the internet.

VendorsFortinet

ProductsFortiMail FortiGate

OrganizationsCISA Fortinet Canadian Centre for Cyber Security

CountriesUnited States Canada

Coverage timelineoldest first · each row is one article

Oct 1, 22:42 UTC · 1d ago
BleepingComputer· 85
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
Fortinet says critical FortiMail flaw CVE-2026-104286 is being exploited in zero-day attacks.
Oct 2, 02:19 UTC · 21h ago
Cyber Security News· 88
Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks
Attackers are exploiting critical FortiMail zero-day CVE-2026-104286 to write files without authentication.
Oct 2, 05:14 UTC · 19h ago
GBHackers· 85
Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers

Vulnerabilities in this storyAll →

CVE-2025-327569.830%
Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone
published May 13, 2025· Fortinet FortiMail KEV
CVE-2026-1042869.8

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2025-32756	Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone CVE-2025-32756 is a stack-based buffer overflow (CWE-124) in Fortinet's FortiMail, FortiVoice, FortiNDR and FortiFone products that is reachable over the network and requires no authentication. An attacker triggers the flaw by sending crafted HTTP requests to the affected device's web-facing service. Successful exploitation yields arbitrary code or command execution on the appliance, giving the attacker control of the device and any traffic or data it handles (such as email or voice services). Organizations running these Fortinet appliances or phones are affected, particularly where the devices are reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-14, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is unconfirmed, and EPSS puts its 30-day exploitation probability at about 30% (98th percentile). Do: Inventory your environment for FortiMail, FortiVoice, FortiNDR and FortiFone deployments and apply the patched releases specified in Fortinet's advisory for CVE-2025-32756. Until patched, restrict internet exposure of the affected devices' HTTP/HTTPS interfaces (limit admin and web access to trusted networks/VPN) per vendor mitigation guidance, and review device logs for signs of exploitation. Federal agencies must apply the required mitigations or discontinue use per BOD 22-01 deadlines.	9.8	30%	KEV	Fortinet FortiMail Fortinet FortiVoice Fortinet FortiNDR +1 more	largeLikely on the order of tens of thousands of deployed appliances/phones (estimate)	May 13, 2025 KEV May 14, 2025
CVE-2026-104286	Unauthenticated path traversal file write in Fortinet FortiMail Fortinet FortiMail has a path traversal flaw combined with improper neutralization of a NULL byte (CWE-22 and CWE-158). An unauthenticated attacker can send crafted HTTP or HTTPS requests that write arbitrary files on the underlying system. Successful exploitation can place attacker-controlled content on the appliance and may be used to alter its behavior or persist access. The issue affects Fortinet FortiMail; specific version ranges are not listed in the available data, and CVSS has not yet been scored. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-01, so exploitation in the wild is confirmed, while ransomware use and a public proof of concept are not known. Do: Apply Fortinet's fixes or mitigations for CVE-2026-104286 immediately, in line with CISA BOD 26-04, and treat internet-exposed FortiMail as highest priority. If a vendor fix is unavailable, restrict HTTP/HTTPS management access or discontinue use. Review systems added to the KEV catalog on 2026-10-01 for unexpected file writes and follow CISA forensics triage requirements.	9.8	2%	KEV PoC	Fortinet FortiMail

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2025-32756

Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone

CVE-2025-32756 is a stack-based buffer overflow (CWE-124) in Fortinet's FortiMail, FortiVoice, FortiNDR and FortiFone products that is reachable over the network and requires no authentication. An attacker triggers the flaw by sending crafted HTTP requests to the affected device's web-facing service. Successful exploitation yields arbitrary code or command execution on the appliance, giving the attacker control of the device and any traffic or data it handles (such as email or voice services). Organizations running these Fortinet appliances or phones are affected, particularly where the devices are reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-14, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is unconfirmed, and EPSS puts its 30-day exploitation probability at about 30% (98th percentile).

Do: Inventory your environment for FortiMail, FortiVoice, FortiNDR and FortiFone deployments and apply the patched releases specified in Fortinet's advisory for CVE-2025-32756. Until patched, restrict internet exposure of the affected devices' HTTP/HTTPS interfaces (limit admin and web access to trusted networks/VPN) per vendor mitigation guidance, and review device logs for signs of exploitation. Federal agencies must apply the required mitigations or discontinue use per BOD 22-01 deadlines.

9.8

30%

KEV

Fortinet FortiMail
Fortinet FortiVoice
Fortinet FortiNDR
+1 more

largeLikely on the order of tens of thousands of deployed appliances/phones (estimate)

May 13, 2025

KEV May 14, 2025

CVE-2026-104286

Unauthenticated path traversal file write in Fortinet FortiMail

Fortinet FortiMail has a path traversal flaw combined with improper neutralization of a NULL byte (CWE-22 and CWE-158). An unauthenticated attacker can send crafted HTTP or HTTPS requests that write arbitrary files on the underlying system. Successful exploitation can place attacker-controlled content on the appliance and may be used to alter its behavior or persist access. The issue affects Fortinet FortiMail; specific version ranges are not listed in the available data, and CVSS has not yet been scored. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-01, so exploitation in the wild is confirmed, while ransomware use and a public proof of concept are not known.

Do: Apply Fortinet's fixes or mitigations for CVE-2026-104286 immediately, in line with CISA BOD 26-04, and treat internet-exposed FortiMail as highest priority. If a vendor fix is unavailable, restrict HTTP/HTTPS management access or discontinue use. Review systems added to the KEV catalog on 2026-10-01 for unexpected file writes and follow CISA forensics triage requirements.

9.8

KEV PoC

Fortinet FortiMail