Exploit
Critical FortiMail vulnerability CVE-2026-104286 actively exploited in zero-day attacks
October 2, 2026
Cybersecurity
Exploit
Key Facts
Signal Type
Exploit
Industry
Cybersecurity
Companies
Fortinet, CISA
Date
October 2, 2026
Fortinet issued a warning about a critical vulnerability in FortiMail, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks. The flaw, rated 9.8 on the CVSS scale, affects the FortiMail management interface and allows unauthenticated attackers to execute arbitrary commands via crafted HTTP or HTTPS requests.
The vulnerability is caused by improper path traversal and NULL byte handling. Fortinet is coordinating with CISA and has published indicators of compromise, including specific IP addresses associated with the attacks.
Affected versions include FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9. Any organization running these versions of FortiMail with the management interface exposed is at risk.
Fortinet has advised customers to apply workarounds, such as disabling the IBE feature or restricting access to the management interface, until security updates are available.
This zero-day creates an urgent opening for cybersecurity vendors and service providers. Fortinet customers need immediate help assessing exposure, applying mitigations, and planning for patch deployment.
Watch for Fortinet and CISA updates regarding patches for CVE-2026-104286. Security updates are pending for all affected FortiMail versions.
Also monitor for additional indicators of compromise and any evidence of broader exploitation tied to the published IP addresses.
Source:
ThreatCluster Threat FeedGet cybersecurity signals in your CRM
Data breaches, ransomware events, funding rounds, and M&A across security vendors and targets.
