Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CISA has added a critical FortiMail flaw to its Known Exploited Vulnerabilities catalog after confirming it is being actively abused in attacks. Tracked as CVE-2026-104286 (CVSS 9.8), the bug combines a path traversal weakness with improper handling of NULL bytes, letting an attacker with no credentials plant arbitrary files on the system through specially crafted HTTP or HTTPS requests. The issue hits FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9, with Fortinet preparing fixed builds (8.0.2, 7.6.7, 7.4.9, or migration to the 7.4 branch for 7.2.x users) while advising admins to disable the IBE encryption feature and block internet access to the management interface in the meantime. Fortinet has published indicators of compromise, including two attacker IP addresses and several altered or newly dropped files such as liblog.so, webconsole and httpd.conf, and federal agencies have been told to remediate by October 4, 2026.