Fortinet FortiMail Path Traversal Actively Exploited — CISA Adds to KEV Catalog
Written by AI from the linked story. Not reviewed by an editor. How this works
A path traversal vulnerability in Fortinet FortiMail (CVE-2026-104286) is being actively exploited in the wild, prompting CISA to add it to the Known Exploited Vulnerabilities Catalog. Path traversal flaws allow attackers to access files and directories outside of the intended scope, potentially exposing sensitive configuration data, credentials, or system files on publicly exposed email security gateways. The active exploitation status means organizations cannot afford a slow patching cadence — threat actors are already weaponizing this flaw. Federal agencies are legally obligated under BOD 26-04 to remediate KEV-listed vulnerabilities within prescribed timelines, and private sector organizations should treat the KEV Catalog as an urgent signal to act.
Tactical Insight
Immediate actions
- Apply Fortinet's official patch or upgrade FortiMail to the latest fixed version as directed in the vendor security advisory.
- Audit all internet-facing FortiMail deployments and restrict administrative and public-facing interfaces to trusted IP ranges only.
Long-term improvements
- Integrate the CISA KEV Catalog as an automated feed into your vulnerability management platform to trigger priority alerts on new additions.
- Maintain a continuously updated asset inventory that tags all internet-exposed appliances for accelerated patch SLAs.
- Establish a formal emergency patching procedure with defined remediation windows (e.g., 24–72 hours) for actively exploited critical vulnerabilities.
Detection measures
- Enable detailed logging on FortiMail and ship logs to a SIEM to detect anomalous path traversal patterns (e.g., `../` sequences in request URLs).
- Deploy web application firewall (WAF) or IPS rules that detect and block path traversal exploitation attempts against mail gateway interfaces.
- Conduct immediate threat hunting across FortiMail logs for indicators of compromise associated with CVE-2026-104286.