Reported by 27 outlets
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
Why this score
- Breadth
- 2.00 / 2.0 · 27 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Fortinet disclosed on a Thursday that CVE-2026-104286 in FortiMail is being exploited as a zero-day. The flaw combines path traversal (CWE-22) with improper NULL byte neutralization (CWE-158) and lets an unauthenticated attacker write arbitrary files on the underlying system via crafted HTTP or HTTPS requests to the management interface. CVSS is 9.8, and Kudelski Security's analysis concludes it enables unauthenticated remote code execution. Fortinet's Gwendal Guégniaud found it internally, and the exploitation acknowledgment means the discovery was not the starting gun.
Affected versions span FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. No fixed release is out yet for 7.4, 7.6, and 8.0; Fortinet lists 7.4.9, 7.6.7, and 8.0.2 as upcoming. Only 7.2 users have a direct exit, upgrading to the 7.4 branch. The interim mitigation is disabling the IBE (internal BFV/IBE) feature. CISA added the flaw to the KEV catalog on October 1, 2026, giving US federal civilian agencies an October 4 remediation deadline.
FortiMail sits at the email perimeter handling exactly the traffic ransomware operators want, and an arbitrary file write on it means persistence and configuration tampering on a device that inspects everyone's mail.
Watch for the patched releases, evidence of mass exploitation or ransomware deployment against FortiMail instances, whether the IBE workaround breaks legitimate mail flows enough that admins disable it and re-expose themselves, and additional Fortinet products pulled into the same code path.
Timeline
-
original reporting
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
bleepingcomputer.com · 12d ago · October 1st, 2026
Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. The vulnerability is rated critical, with a CVSS score of 9.8, and affects the FortiMail management interface. "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests," Fortinet said in an advisory published Thursday. Gwendal Guégniaud of Fortinet's Product Security team discovered the vulnerability internally, and it affects FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, and FortiMail 7.2.0 through 7.2.9. Fortinet says the flaw is being actively exploited and is urging customers to apply the shared workarounds until a security update can be installed. FortiMail 7.2 users can patch the vulnerability by upgrading to the 7.4 branch or later. For affected FortiMail 7.4, 7.6, and 8.0 installations, security updates are not yet available, with Fortinet listing FortiMail 7.4.9, 7.6.7, and 8.0.2 as upcoming versions containing the fix. Until patched versions are available, Fortinet says admins can mitigate the flaw by disabling IBE feature support using the following commands: config system
-
update from secdb.nttzen.cloud
🚨 [CISA-2026:1001] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 12d ago · October 1st, 2026
🚨 [CISA-2026:1001] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1001
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-104286 (CVSS 9.8): critical FortiMail flaw exploited in the wild. Unauthenticated path traversal + NULL byte (CWE-22/CWE-158) let
www.bleepingcomputer.com · 12d ago · October 1st, 2026
-
mentioned by ninjasignal.ninja
🚨 NEW on CISA KEV — exploited in the wild 🛡 Fortinet FortiMail Fortinet FortiMail Path Traversal Vulnerability CVE: CVE-2026-104286 · patch
ninjasignal.ninja · 12d ago · October 2nd, 2026
-
update from www.yazoul.net
🔴 New security advisory: CVE-2026-104286 affects multiple systems. • Impact: Remote code execution or complete system compromise possible •
www.yazoul.net · 12d ago · October 2nd, 2026
🔴 New security advisory: CVE-2026-104286 affects multiple systems. • Impact: Remote code execution or complete system compromise possible •
via Mastodon https://www.yazoul.net/advisory/cve/cve-2026-104286-fortimail-path-traversal-exploited-in-the-wild
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-104286 affects multiple systems. • Impact: Remote code execution or complete system compromise possible •
www.yazoul.net · 12d ago · October 2nd, 2026
-
mentioned by cyberworldops.eu
Fortinet FortiMail management interface is impacted by CVE-2026-104286 (CVSS 9.8), exploited in the wild as zero-day for unauthenticated sys
cyberworldops.eu · 12d ago · October 2nd, 2026
-
update from gbhackers.com
Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers
gbhackers.com · 11d ago · October 2nd, 2026
Fortinet has disclosed a critical vulnerability in FortiMail that attackers are actively exploiting to compromise vulnerable email security appliances. Fortinet FortiMail Path Traversal Flaw […] The post Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by vulnerability.circl.lu
CVE-2026-104286 — FortiMail, critical vulnerability already exploited as a zero-day
vulnerability.circl.lu · 11d ago · October 2nd, 2026
-
update from securityweek.com
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
securityweek.com · 11d ago · October 2nd, 2026
The US Cybersecurity and Infrastructure Security Agency (CISA) and Fortinet on Thursday sounded the alarm on a critical FortiMail vulnerability that has been exploited in the wild. Patches have yet to be released. Threat actors could exploit the issue via crafted HTTP or HTTPS requests, potentially gaining arbitrary code or command execution. Fortinet has published an advisory describing the security defect, urging organizations to disable the IBE feature support or disable access to the FortiMail management interface from the web and limit access to trusted sources. “This has been reported to be exploited in the wild; customers are urged to apply the workaround,” the company said. Fortinet also published indicators of compromise (IoCs) to help security teams hunt for potential intrusions. On Thursday, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities ( KEV ) catalog, urging federal agencies to address it within three days, as mandated by BOD 26-04. The company says fixes will be included in the upcoming FortiMail
-
update from malware.news
CVE-2026-104286: FortiMail Path Traversal Vulnerability Actively Exploited
malware.news · 11d ago · October 2nd, 2026
Successful exploitation may let an unauthenticated attacker send a crafted request that tricks FortiMail into writing a file outside its intended folder. By placing a file onto the underlying system, the attacker gains a way to run commands on the device itself. This can lead to full control of the mail gateway, exposing stored mail, credentials, and other systems it connects to. Recommended Actions Currently there are no patches available, here are the current workaround as provided by Fortinet’s PSIRT[1]: Disable the IBE feature support using the following CLI command: config system encryption ibe set status disable end Alternatively: Disable access to the FortiMail management interface from the internet or limit the access only from trusted private network Detection Logs[1]: type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ... type=kevent subtype=admin pri=information user=admin ui=(null) action=logout status=success reason=unknown msg="Use
-
mentioned by www.truesec.com
(truesec.com) Critical Path Traversal Vulnerability in FortiMail (CVE-2026-104286) Actively Exploited in the Wild In brief - This article de
www.truesec.com · 11d ago · October 2nd, 2026
-
mentioned by thehackernews.com
A serious security flaw in FortiMail email systems is being used by attackers to gain unauthorized access. If your business uses this softwa
thehackernews.com · 11d ago · October 2nd, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-104286 (CVSS 9.8): critical FortiMail zero-day exploited in the wild. Improper validation lets unauthenticated attackers write ar
www.bleepingcomputer.com · 11d ago · October 2nd, 2026
-
update from malware.news
Fortinet security advisory (AV26-989)
malware.news · 11d ago · October 2nd, 2026
Serial number: AV26-989 Date: October 1, 2026 As of October 1, 2026, Fortinet is affected by vulnerabilities in the following products: FortiMail 8.0 Versions prior to 8.0.2 FortiMail 7.6 Versions prior to 7.6.7 FortiMail 7.4 Versions prior to 7.4.9 FortiMail 7.2 Upgrade to branch 7.4 or above Fortinet indicates that CVE-2026-104286 is exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
-
mentioned by www.cert.se
(cert.se) Critical Arbitrary File Write Vulnerability in FortiMail Management Interface (CVE-2026-104286) In brief - This article alerts use
www.cert.se · 11d ago · October 2nd, 2026
-
update from thecybersecguru.com
FortiMail CVE-2026-104286: Actively Exploited Zero-Day Allows Unauthenticated File Writes https:// lemmy.world/post/52629639
thecybersecguru.com · 11d ago · October 2nd, 2026
FortiMail CVE-2026-104286: Actively Exploited Zero-Day Allows Unauthenticated File Writes https:// lemmy.world/post/52629639
via Mastodon https://thecybersecguru.com/exploits/fortimail-cve-2026-104286-zero-day/
-
mentioned by www.bleepingcomputer.com
There is no patch yet for the FortiMail bug attackers are already using. CVE-2026-104286 is a 9.8 path traversal in Fortinet's mail gateway:
www.bleepingcomputer.com · 11d ago · October 2nd, 2026
-
update from app.opencve.io
Fortinet has a couple of advisories today, one pertaining to a critical vulnerability. CRITICAL: CVE-2026-104286 - Improper Pathname Restric
app.opencve.io · 11d ago · October 2nd, 2026
Fortinet has a couple of advisories today, one pertaining to a critical vulnerability.
-
mentioned by www.theregister.com
🚨 Fortinet sounds the alarm over actively exploited FortiMail zero-day ｢ The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 a
www.theregister.com · 11d ago · October 2nd, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes Vulnerability | CRI
www.yazoul.net · 11d ago · October 2nd, 2026
-
mentioned by censys.com
🚨 Fortinet reports active exploitation of CVE-2026-104286, a critical path traversal vulnerability affecting FortiMail. Censys observes roug
censys.com · 11d ago · October 2nd, 2026
-
update from www.securityweek.com
🚨🐛 SIGINT // Cybersecurity Watch — 2026-10-03 Active exploitation of a FortiMail zero-day demands immediate patching—email gateways remain a
www.securityweek.com · 11d ago · October 2nd, 2026
🚨🐛 SIGINT // Cybersecurity Watch — 2026-10-03 Active exploitation of a FortiMail zero-day demands immediate patching—email gateways remain a
via Mastodon https://www.securityweek.com/exploited-fortinet-fortimail-zero-day-calls-for-urgent-action/
-
mentioned by www.bleepingcomputer.com
# Fortinet warns of critical # FortiMail flaw exploited in zero-day attacks https://www. bleepingcomputer.com/news/secu rity/fortinet-warns-
www.bleepingcomputer.com · 10d ago · October 3rd, 2026
-
update from cyber.netsecops.io
📰 Critical Fortinet FortiMail Zero-Day Exploited for RCE Fortinet warns of critical zero-day (CVE-2026-104286) in FortiMail, actively exploi
cyber.netsecops.io · 10d ago · October 3rd, 2026
📰 Critical Fortinet FortiMail Zero-Day Exploited for RCE Fortinet warns of critical zero-day (CVE-2026-104286) in FortiMail, actively exploi
via Mastodon https://cyber.netsecops.io/articles/critical-fortinet-fortimail-zero-day-exploited-cve-2026-104286/?utm_source=mastodon&utm_medium=social&utm_campaign=daily
-
update from ninjalabz.io
🗞 Probably Fine Daily No. 6 CISA confirms exploitation of a FortiMail zero-day, and adds a two-bug Zammad chain for the weekend Today's thre
ninjalabz.io · 10d ago · October 4th, 2026
🗞 Probably Fine Daily No. 6 CISA confirms exploitation of a FortiMail zero-day, and adds a two-bug Zammad chain for the weekend Today's thre
via Mastodon https://ninjalabz.io/daily/2026-10-03/
-
mentioned by threatnoir.com
2026-W40 — Weekly Threat Roundup 🔥 A zero-day in Fortinet FortiMail (CVE-2026-104286) is actively exploited with no patch available yet, dem
threatnoir.com · 9d ago · October 4th, 2026
-
update from ninjalabz.io
🗞 Probably Fine Daily N. 7 FortiMail entra nel catalogo KEV mentre Citrix NetScaler subisce un secondo colpo in una settimana https:// ninja
ninjalabz.io · 9d ago · October 4th, 2026
🗞 Probably Fine Daily N. 7 FortiMail entra nel catalogo KEV mentre Citrix NetScaler subisce un secondo colpo in una settimana https:// ninja
via Mastodon https://ninjalabz.io/daily/it/2026-10-04/
-
update from www.lemagit.fr
⚠️ [VULN] FortiMail users, critical vulnerability CVE-2026-104286: Fortinet warns of a new critical vulnerability
www.lemagit.fr · 9d ago · October 4th, 2026
Fortinet has warned of a vulnerability affecting FortiMail. Users should apply the patch promptly. via Mastodon https://www.lemagit.fr/actualites/366651574/Utilisateurs-de-FortiMail-patchez
-
mentioned by securityaffairs.com
U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog
securityaffairs.com · 9d ago · October 4th, 2026
-
update from www.fortiguard.com
Another week; another Fortinet vulnerability. Fortinet disclosed CVE-2026-104286 on Oct. 1 and confirmed active exploitation. Path-traversal
www.fortiguard.com · 9d ago · October 4th, 2026
Another week; another Fortinet vulnerability. 1 and confirmed active exploitation.
-
mentioned by thehackernews.com
RESOLUTION NOTES: Patch your FortiMail installations immediately and monitor Fortinet's vendor advisories, or we will close this ticket as "
thehackernews.com · 9d ago · October 5th, 2026
-
mentioned by thehackernews.com
CISA adds CVE-2026-104286 (CVSS 9.8) to KEV—critical flaw in Fortinet FortiMail allowing unauthenticated attackers to write arbitrary files.
thehackernews.com · 8d ago · October 5th, 2026
-
update from diesec.com
FortiMail zero-day CVE-2026-104286 (CVSS 9.8): unauthenticated file write, exploited now, CISA KEV. No fix for 7.4, 7.6, 8.0 as of Oct 2. Di
diesec.com · 8d ago · October 5th, 2026
No fix for 7.4, 7.6, 8.0 as of Oct 2.
-
mentioned by diesec.com
(diesec.com) Critical FortiMail Zero-Day Vulnerability (CVE-2026-104286) Actively Exploited: Arbitrary File Write Enables Unauthenticated At
diesec.com · 8d ago · October 5th, 2026
-
mentioned by cybersecurefox.com
Critical FortiMail vulnerability: unauthenticated arbitrary file write (CVE-2026-104286) 🔗 https:// cybersecurefox.com/en/critical -fortimai
cybersecurefox.com · 8d ago · October 5th, 2026
-
mentioned by kudelskisecurity.com
(kudelskisecurity.com) Critical Path Traversal Vulnerability in Fortinet FortiMail Enables Unauthenticated Remote Code Execution In brief -
kudelskisecurity.com · 8d ago · October 5th, 2026
-
update from socprime.com
CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes
socprime.com · 8d ago · October 5th, 2026
The vulnerability poses a significant risk because FortiMail appliances are often positioned at the enterprise perimeter to protect email infrastructure against phishing, malware, spam, and business email compromise. A weakness that allows attackers to manipulate files on such an internet-facing security appliance can open the door to persistence, configuration tampering, malware deployment, and potentially broader compromise. Federal Civilian Executive Branch agencies were instructed to apply the vendor-recommended remediation or mitigations by October 4, highlighting the urgency of the issue. Security teams looking for CVE-2026-104286 detection content can leverage SOC Prime’s AI-Native Detection Intelligence Platform to identify suspicious behavior associated with exploitation attempts and post-compromise activity. Click Explore Detections to access relevant detection rules and hunting queries mapped to MITRE ATT&CK® and compatible with multiple SIEM, EDR, and Data Lake technologies. Security professiona
-
mentioned by www.secpoint.com
FortiMail security alert: actively exploited vulnerability CVE-2026-104286 can allow an unauthenticated attacker to write arbitrary files th
www.secpoint.com · 5d ago · October 8th, 2026