CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

Actively exploited: added to CISA’s KEV catalog on October 1, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: October 4, 2026.

Description from CISA’s KEV catalog.

Our analyses

FortiMail critical flaw exploited before a patch was available (CVE-2026-104286)

Fortinet warns of a FortiMail flaw rated 9.8/10 that was exploited before any patch existed. Fixed versions are now available on all maintained branches. Here are the affected branches, the workaround to apply and the indicators of compromise.

Oct 11, 20262 min read

Cybersecurity

Cisco: a booby-trapped email may be enough to take over your gateway, and the flaw is already exploited

Rated 9.8 out of 10, the flaw requires no password or account once attachment scanning is enabled. The patch installs without a reboot: here's how to tell if you're exposed.

Oct 15, 20263 min read

CERT-FR alerts and notices

CERTFR-2026-AVI-1257Oct 2

Vulnérabilité dans Fortinet FortiMail (02 octobre 2026)

What to do

Check whether your estate includes Fortinet FortiMail, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (fortiguard.fortinet.com)
NVD entry (NIST)
CISA KEV catalog

Other Fortinet vulnerabilities

All exploited Fortinet vulnerabilities

CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

Our analyses

FortiMail critical flaw exploited before a patch was available (CVE-2026-104286)

Cisco: a booby-trapped email may be enough to take over your gateway, and the flaw is already exploited

CERT-FR alerts and notices

Vulnérabilité dans Fortinet FortiMail (02 octobre 2026)

What to do

References

Other Fortinet vulnerabilities

Fortinet Multiple Products Path Traversal Vulnerability

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiClient EMS SQL Injection Vulnerability