FortiMail CVE-2026-104286 Is Under Active Exploitation

Fortinet FortiMail is being attacked through CVE-2026-104286, a critical path-traversal flaw that requires no login and permits arbitrary file writes. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on October 1, 2026, while reporting the next day said exploitation was underway and some administrators were still awaiting patches. FortiMail operators should treat this as an active compromise risk, not a routine patching item.

• CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities Catalog on October 1, 2026, citing evidence of active exploitation.
• The flaw carries a CVSS score of 9.8 and allows unauthenticated attackers to write arbitrary files on the underlying FortiMail system.
• A report published October 2 said exploitation was underway, required no login, and that some administrators were still waiting for patches.
• CISA described the vulnerability class as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise.

Bottom line If you run FortiMail, identify affected systems and prioritize containment, investigation, and remediation immediately; federal civilian agencies should follow the applicable CISA vulnerability-management requirements.