A Critical Fortinet Vulnerability Has Been Exploited in the Wild, Urgent Action Required
The US Cybersecurity and Infrastructure Security Agency (CISA) and Fortinet have sounded the alarm on a severe vulnerability in FortiMail that has already been exploited by threat actors. The zero-day flaw, tracked as CVE-2026-104286 with a CVSS score of 9.8, allows attackers to write arbitrary files to the underlying system through carefully crafted HTTP or HTTPS requests.
This critical issue affects multiple versions of FortiMail, including 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. According to Fortinet, the vulnerability was discovered internally, but patches have not yet been released.
Threat actors can exploit CVE-2026-104286 by sending malicious HTTP or HTTPS requests to vulnerable systems, potentially gaining arbitrary code or command execution. This means that attackers could compromise a system’s integrity and gain unauthorized access to sensitive data.
To mitigate the risk, Fortinet has published an advisory urging organizations to take immediate action. The company recommends disabling the IBE feature support or limiting access to the FortiMail management interface from the web, and only allowing trusted sources to access it. Additionally, Fortinet has provided indicators of compromise (IoCs) to help security teams detect potential intrusions.
The US CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog, urging federal agencies to address the issue within three days as mandated by BOD 26-04. This is a clear indication that the vulnerability poses a significant risk and requires prompt attention.
It’s essential for FortiMail users to take this warning seriously and implement the recommended mitigations as soon as possible. With patches not yet available, disabling the IBE feature support or limiting access to the management interface is crucial to prevent potential exploitation.
In light of this critical vulnerability, it’s clear that organizations must remain vigilant and proactive in their security efforts. Regularly monitoring systems for signs of compromise, staying up-to-date with the latest security patches, and implementing robust security controls are essential in preventing such attacks.
As a result of this incident, we recommend that all FortiMail users take immediate action to mitigate the risk posed by CVE-2026-104286. Disabling the IBE feature support or limiting access to the management interface from the web is a crucial step in preventing potential exploitation. Regularly monitoring systems for signs of compromise and staying informed about the latest security patches will also help organizations stay ahead of emerging threats.
Source: SecurityWeek — 2026-10-02