CISA Adds One Known Exploited Vulnerability to Catalog

A path traversal vulnerability in Fortinet FortiMail (CVE-2026-104286) is being actively exploited in the wild, prompting CISA to add it to the Known Exploited Vulnerabilities Catalog. Path traversal flaws allow attackers to access files and directories outside of the intended scope, potentially exposing sensitive configuration data, credentials, or system files on publicly exposed email security gateways. The active exploitation status means organizations cannot afford a slow patching cadence — threat actors are already weaponizing this flaw. Federal agencies are legally obligated under BOD 26-04 to remediate KEV-listed vulnerabilities within prescribed timelines, and private sector organizations should treat the KEV Catalog as an urgent signal to act.