GoKawiilFortinet discloses actively exploited FortiMail zero-day, CVE-2026-104286
Fortinet has disclosed a critical path traversal vulnerability in FortiMail's management interface, scoring 9.8 on CVSS, that attackers are already exploiting to write arbitrary files without authentication. The flaw affects FortiMail versions 7.2 through 8.0.1, and was discovered internally by Fortinet's Product Security team. Patches are not yet available for most affected branches, though fixed versions are planned.