FortiMail zero-day CVE-2026-104286 exploited, added to CISA KEV

A critical FortiMail zero-day, CVE-2026-104286, is being exploited in the wild, and Fortinet disclosed both the flaw and its active abuse in the same advisory. The bug lets an unauthenticated attacker write arbitrary files to the underlying system of an internet-facing email security appliance, using nothing more than crafted HTTP or HTTPS requests. Fortinet published advisory FG-IR-26-175 on October 1, 2026, and CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog the same day, giving federal agencies three days to respond. For a device that sits in the path of a company's email, that is close to a worst-case profile.

What happened

Fortinet describes CVE-2026-104286 as a combination of two weaknesses: a path traversal (CWE-22) and the improper neutralization of a NULL byte or character (CWE-158). Chained, they let an attacker escape the directory the application intends to write within and place a file anywhere on disk, with no login required (Fortinet). The company rates it CVSS 9.8, critical, in its PSIRT advisory, alongside a temporal score of 8.8; most reporting carries the 9.8 base figure (BleepingComputer, Help Net Security).

The vulnerable code sits in FortiMail's web interface, in the component that backs its Identity-Based Encryption (IBE) feature, which is why Fortinet's primary workaround is to turn IBE off (SOC Prime). An arbitrary file write can sound limited next to remote code execution, but on an appliance like this the distance is short. Yordan Ganchev of watchTowr told Cybersecurity Dive the flaw is "trivial to exploit," and noted that an attacker who can place a file on the system can generally go on to run commands on it (Cybersecurity Dive). Fortinet's own indicators bear that out: in observed attacks the company saw new and modified system files, including a replaced shared library and an added ld.so.preload entry, a well-worn route to persistence and code execution (BleepingComputer).

DISCLOSURE TO DEADLINE

Fortinet credits the discovery to Gwendal Guegniaud of its Product Security team, who found the bug internally (Help Net Security). That the vendor both found and disclosed it while attackers were already using it is what makes this a zero-day rather than a routine patch. Fortinet published its indicators for threat hunting rather than attribution: two source IP addresses, 79.141.169[.]187 and 45.129.0[.]192, an attacker-configured archive account named archive234 pointed at remote storage, and a cron job tied to the appliance's /migadmin path (BleepingComputer). The company has not said when the attacks began, how many systems were hit, or who is behind them.

Why it matters

FortiMail is a security appliance, and that is exactly what makes a flaw like this dangerous. Email gateways sit in the direct path of inbound and outbound mail, they hold credentials and message content, and they are reachable from the internet by design. A bug that turns one into an attacker's foothold does not just expose email; it hands over a trusted position inside the network. eSecurity Planet put the structural point plainly: a vulnerable security appliance "can become another attack surface rather than the barrier organizations expect it to be" (eSecurity Planet).

The pattern is familiar because it keeps repeating. In the weeks around this disclosure, researchers documented an Ivanti Connect Secure zero-day chain that reached root on fully patched VPNs and a separate Cisco ASA and FTD VPN zero-day under active exploitation. Edge appliances share a profile attackers have learned to prize: reachable from outside, privileged on the inside, and rarely carrying the endpoint tooling that would catch an intrusion anywhere else. The gap between an organization's attack surface and the attack paths through it is exactly where these devices live.

The timing sharpens the point. CVE-2026-104286 landed in the same month Fortinet shipped an out-of-band security hardening release for FortiOS, FortiManager, and FortiAnalyzer, announced around October 21 and 22, with the individual CVE identifiers and detailed descriptions held back until November 10 (Rescana, Canadian Centre for Cyber Security). It was one entry in a record run of October 2026 disclosures, and the appliances a team forgot it owned are the ones that stay both unpatched and uninvestigated.

A security appliance on the edge of your network is a defense only while it is patched. The moment it is vulnerable, it is the softest way in.

The Threatless read

The honest lesson of CVE-2026-104286 is not that FortiMail is uniquely weak. It is that the first question after an edge-device advisory is rarely the patch. It is exposure: which FortiMail appliances do you actually run, which are reachable from the internet, whether IBE is enabled on them, and what each one can touch if it falls. A team that can answer those questions in minutes treats this advisory as a short, ranked list of devices to fix. A team that cannot treats it as a fire drill.

That is the difference between tracking a CVE and understanding your risk. A score of 9.8 matters, but what moves a flaw to the top of the queue is the combination the KEV catalog captures: unauthenticated, remote, and already exploited. Prioritizing by that reality rather than by raw severity alone is the discipline behind CVE, CVSS, EPSS, and KEV scoring and the wider practice of vulnerability prioritization. Keeping an inventory current enough to act on is the premise of continuous threat exposure management, and it is what Threatless CTEM is built for: AI-native exposure management that keeps the picture of what you expose current, so an email gateway you deployed two years ago still shows up the moment it suddenly matters.

The practical next steps are unchanged by any of that. Locate the FortiMail appliances you run and check each version against Fortinet's advisory. Disable IBE, or pull the management interface off the internet, until you can patch. Move to 7.4.9, 7.6.7, or 8.0.2, confirm FortiMail Cloud is covered, and because this one was exploited quietly before anyone outside Fortinet knew, go and look at the appliances that were exposed. The patch closes the door. It does not tell you who already walked through it.