Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Fortinet has disclosed that a critical path traversal and NULL-byte handling bug in FortiMail's management interface, CVE-2026-104286, is already being exploited as a zero-day to plant malicious files and run unauthorized commands. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker write arbitrary files on the underlying system through specially crafted HTTP or HTTPS requests. It impacts FortiMail versions 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9; only the 7.2 branch has an immediate fix via upgrade to 7.4 or later, while fixed builds 7.4.9, 7.6.7 and 8.0.2 are still pending for the other branches. Until then, Fortinet recommends disabling the IBE feature or blocking internet access to the management interface, and has released IOCs, suspicious IP addresses, and log signatures tied to the intrusions. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 4th to investigate and remediate affected systems.