Critical FortiMail flaw CVE-2026-104286 reportedly under zero-day exploitation

Reported arbitrary file writes through HTTP requests

Fortinet reportedly warned that CVE-2026-104286, rated 9.8 on the CVSS severity scale, is being actively exploited against FortiMail. The company says crafted HTTP or HTTPS requests can allow an unauthenticated attacker to write arbitrary files on the underlying system.

Fortinet advised disabling IBE support or limiting management-interface access until updates are available. The report says FortiMail 7.2 can be addressed by upgrading to 7.4 or later, while fixes for affected 7.4, 7.6, and 8.0 versions are listed as upcoming. It also says CISA added the issue to its Known Exploited Vulnerability catalog and set an October 4 mitigation deadline for federal agencies.

The report does not establish a comparable prior exposure level or number of affected systems.

Fortinet reportedly disclosed active exploitation of CVE-2026-104286 and provided mitigations while fixes for several affected FortiMail branches remain forthcoming. CISA has also added the flaw to its Known Exploited Vulnerability catalog, according to the report.

Mitigations for branches awaiting fixes

The reported issue concerns a management interface and is described as actively exploited before fixes are available for several affected release branches. The report does not say when exploitation began, how many systems were compromised, or who carried out the attacks.