FortiMail zero-day CVE-2026-104286 is already exploited

Fortinet is addressing a critical path-traversal flaw CVE-2026-104286 in FortiMail rated CVSS 9.8, allowing unauthenticated attackers to write arbitrary files via crafted HTTP/HTTPS requests. CISA added it to the KEV catalog on October 1, 2026, with a federal remediation deadline of October 4. Affected branches include 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9.

• CVSS 9.8: unauthenticated path traversal with no user interaction
• Added to CISA KEV on October 1, 2026; federal deadline October 4
• Fixes: 8.0.2, 7.6.7 and 7.4.9; the 7.2 branch must be abandoned
• Workaround: disable IBE or keep the management interface off the internet