Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

CISA and Fortinet have issued an urgent warning about a severe FortiMail vulnerability, CVE-2026-104286 (CVSS 9.8), that is already being exploited by attackers despite no official patch being available yet. The bug combines a path traversal issue with improper handling of NULL bytes, letting attackers send specially crafted HTTP or HTTPS requests to write files onto the system and potentially achieve remote code execution. It affects FortiMail releases from 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1 — versions found internally by Fortinet rather than through outside reporting. Until fixes land in the planned 7.4.9, 7.6.7, and 8.0.2 releases, Fortinet recommends turning off IBE functionality or restricting access to the management interface, and has shared indicators of compromise for defenders. CISA has also added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies just three days to remediate under BOD 26-04, though specifics about the attacks remain undisclosed.