GoKawiilFortinet discloses actively exploited FortiMail zero-day, CVE-2026-104286
Fortinet has disclosed a critical path traversal vulnerability in FortiMail's management interface, scoring 9.8 on CVSS, that attackers are already exploiting to write arbitrary files without authentication. The flaw affects FortiMail versions 7.2 through 8.0.1, and was discovered internally by Fortinet's Product Security team. Patches are not yet available for most affected branches, though fixed versions are planned.
GoKawiil's interpretation of the reporting above, not reported fact.
Active exploitation before a patch exists leaves many organizations exposed, since the only current defenses are workarounds like disabling IBE support or restricting management interface access. The severity score and unauthenticated attack vector suggest email infrastructure could be compromised at scale if administrators don't act quickly. Fortinet's release of indicators of compromise implies it has already observed real intrusions tied to this flaw.
- CVE-2026-104286 is a critical 9.8-severity path traversal flaw in FortiMail's management interface.
- No official patch exists yet for FortiMail 7.4, 7.6, or 8.0; only 7.2 users can upgrade to a fixed branch now.
- Fortinet recommends disabling IBE support or restricting management interface access as temporary mitigations.
YubiKey 5 Series Security Key — With critical FortiMail flaws being exploited via unauthenticated attacks on management interfaces, hardening admin access with hardware-backed MFA is a smart defensive layer. A YubiKey adds strong phishing-resistant authentication to admin consoles and email systems, reducing risk while patches are rolled out.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-01
Published there as: “Fortinet warns of critical FortiMail flaw exploited in zero-day attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.