Executive Summary
Fortinet has confirmed active exploitation of a critical FortiMail zero-day, CVE-2026-104286. The vulnerability carries a CVSS score of 9.8 and can allow an unauthenticated attacker to write arbitrary files to the underlying FortiMail system.
CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog, making this an immediate priority for organizations running affected FortiMail versions.
What is the vulnerability?
CVE-2026-104286 involves path traversal and NULL-byte handling weaknesses.
An attacker can send specially crafted HTTP/HTTPS requests without authentication and potentially write arbitrary files to the FortiMail system.
The affected versions include:
- FortiMail 7.2.0–7.2.9
- FortiMail 7.4.0–7.4.8
- FortiMail 7.6.0–7.6.6
- FortiMail 8.0.0–8.0.1
Fortinet has indicated fixes for newer branches, including 7.4.9, 7.6.7 and 8.0.2.
Exploited in the Wild
The important part is that this is not just a newly disclosed critical CVE.
Fortinet has confirmed that exploitation is already occurring in the wild, and CISA has subsequently added the vulnerability to KEV.
However, the publicly available information does not yet establish the responsible threat actor, the full attack chain or the scale of compromise. Those details should not be assumed.
What security teams should do
Organizations running affected FortiMail versions should immediately:
- Apply Fortinet’s recommended mitigation.
- Disable IBE functionality where applicable.
- Restrict internet access to FortiMail management interfaces.
- Identify all exposed FortiMail appliances and affected versions.
- Review logs and system activity for suspicious requests or unexpected file changes.
- Hunt retrospectively for indicators of compromise.
- Patch to the appropriate fixed release as soon as available.
The key point is that mitigation alone is not enough. Since exploitation has already been confirmed, organizations should also determine whether their FortiMail infrastructure was targeted before containment.
Final Takeaway
CVE-2026-104286 combines critical severity, unauthenticated exploitation, an internet-facing security appliance and confirmed exploitation in the wild.
For FortiMail customers, this should be treated as both a vulnerability-management and incident-response event.
Contain it. Hunt for exploitation. Then patch.
