Critical FortiMail zero-day exploited; urgent mitigations advised

A critical zero-day vulnerability in Fortinet’s FortiMail appliances, tracked as CVE-2026-104286 with a CVSS score of 9.8, is being exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog and Fortinet urged customers to apply workarounds while fixes are prepared.

The defect combines a path traversal issue with improper handling of NULL bytes. An attacker can send crafted HTTP or HTTPS requests that cause the appliance to write arbitrary files to the underlying system, which can enable execution of arbitrary code or commands.

Fortinet discovered the issue internally. Affected FortiMail versions include 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. Fortinet plans to include fixes in upcoming builds 7.4.9, 7.6.7 and 8.0.2 but has not provided release dates.

CISA added CVE-2026-104286 to the KEV list on Thursday and directed federal agencies to address the vulnerability within three days under Binding Operational Directive 26-04. Neither CISA nor Fortinet has released technical details about the attacks observed in the wild.

Fortinet published an advisory and supplied indicators of compromise to help organizations hunt for intrusions. The advisory recommends temporarily disabling IBE feature support, blocking web access to the FortiMail management interface, and restricting management access to trusted sources only.

Security teams are advised to monitor for the supplied IoCs and to review network and system logs for signs of exploitation. Appliances exposed to the internet or with overly permissive management access face the highest risk until firmware updates are available.

Fortinet wrote: “This has been reported to be exploited in the wild; customers are urged to apply the workaround.”