Security1 hOctober 6, 2026, 10:40

After CVE-2026-104286: A Compromise Assessment Plan for FortiMail

Fortinet FortiMail is affected by CVE-2026-104286, a CVSS 9.8 path traversal allowing unauthenticated file writes via crafted HTTP/HTTPS requests. Fortinet reports exploitation in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 1, 2026.

DEV Community

Open source

After CVE-2026-104286: A Compromise Assessment Plan for FortiMail

CVSS 9.8: unauthenticated file writes via HTTP/HTTPS requests
CISA added CVE-2026-104286 to KEV on October 1, 2026
The 7.0 branch has no named fix — migrate to a fixed build
Confirmed compromise requires rebuild from a trusted image

#Fortinet#FortiMail#CISA

Fortinet confirms FortiMail zero-day: patching does not remove the backdoor

Security

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Security

Attacker compromised nearly 1,000 Zyxel switches via CVE-2026-7273

Policy

After CVE-2026-104286: A Compromise Assessment Plan for FortiMail

Fortinet confirms FortiMail zero-day: patching does not remove the backdoor

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Attacker compromised nearly 1,000 Zyxel switches via CVE-2026-7273

Democrats seek top-to-bottom assessment of CISA workforce