CISA adds Fortinet FortiMail zero-day to exploited vulnerabilities catalog

October 2, 2026 at 10:49 AM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The U.S. Cybersecurity and Infrastructure Security Agency added a critical Fortinet FortiMail vulnerability to its Known Exploited Vulnerabilities catalog on Thursday. The flaw, tracked as CVE-2026-104286 with a CVSS score of 9.8, allows unauthenticated attackers to write arbitrary files. Federal agencies must apply patches or workarounds by October 4, 2026.

Key Facts

CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on Thursday after reports of active exploitation.
The vulnerability has a CVSS score of 9.8 and allows unauthenticated attackers to write arbitrary files via crafted HTTP or HTTPS requests.
Fortinet credited Gwendal Guégniaud of its Product Security team with discovering and reporting the flaw.
Federal Civilian Executive Branch agencies are recommended to apply the patch or workarounds by October 4, 2026.

Vulnerability Details

The flaw stems from improper limitation of a pathname to a restricted directory and improper neutralization of NULL bytes. Fortinet's advisory states the vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system. Affected versions include FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

Mitigation and Indicators

Fortinet urges customers to disable IBE feature support and restrict access to the FortiMail management interface from the internet. The company shared indicators of compromise including IP addresses 79.141.169.187 and 45.129.0.192. Modified files include /bin/smit, /data/etc/httpd.conf, and /data/migadmin.tar.gz.