Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
Fortinet FortiMail zero-day vulnerability (CVE-2026-104286) exploited in the wild.
CISA and Fortinet have issued warnings about a critical zero-day vulnerability, CVE-2026-104286, affecting multiple versions of FortiMail. This path traversal flaw allows attackers to write arbitrary files and potentially execute code. The vulnerability has reportedly been exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities catalog, mandating federal agencies to address it within three days. While patches are not yet available, Fortinet recommends disabling the IBE feature or restricting web management access as workarounds.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical path traversal zero-day vulnerability in Fortinet FortiMail (CVE-2026-104286) is being actively exploited before a patch is available, leaving organizations reliant on workarounds to reduce exposure. The flaw allows attackers to write arbitrary files and potentially execute remote code, making it a high-severity threat to email gateway infrastructure. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog and the three-day remediation mandate for federal agencies underscores the urgency of the risk. This incident highlights the danger of internet-facing security appliances that themselves become attack vectors, and the critical importance of having compensating controls ready when patches are unavailable.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-104286