CVE Tools
Track your stack

Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)

Help Net SecurityBy Sinisa Markovic

Reported exploitedFortiMail

Our summary

Fortinet says attackers are actively exploiting CVE-2026-104286, a FortiMail zero-day with a CVSSv3 score of 9.8. The path traversal and NULL-byte issue can let an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests on FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fixes are planned for 8.0.2, 7.6.7 and 7.4.9; until then, Fortinet recommends disabling IBE or limiting access to the management interface.

Read at Help Net Security

Help Net Security publishes this story on its own site; we link to it rather than reprint it.

  1. Risky Business NewsShinyHunters suspects arrested in US and JordanCVE-2026-104286
  2. The Hacker News⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsCVE-2026-104286
  3. Help Net SecurityWeek in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploitedCVE-2026-104286
  4. SecurityWeekExploited Fortinet FortiMail Zero-Day Calls for Urgent ActionCVE-2026-104286
  5. The Hacker NewsCritical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File WritesCVE-2026-104286
  6. BleepingComputerFortinet warns of critical FortiMail flaw exploited in zero-day attacksCVE-2026-104286

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure