ZoomEye Finds 3,911 Exposed FortiMail Instances Amid Active Exploitation

ZoomEye found 3,911 FortiMail instances via app fingerprint and 5,322 via page title as of October 4, 2026. CVE-2026-104286, a 9.8 path-traversal file-write flaw, is under active exploitation and was added to CISA's Known Exploited Vulnerabilities catalog on October 1.

• Query app="FortiMail" returned 3,911 matches; title="FortiMail" returned 5,322
• CVE-2026-104286 is a path-traversal file-write flaw rated 9.8
• CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 1, 2026
• The gap between counts reflects different signals and fronting proxies