Fortinet FortiMail zero-day exploited; CISA adds to KEV catalog

· Cybersecurity · United States

Fortinet warned that a critical FortiMail vulnerability, CVE-2026-104286, is being actively exploited in zero-day attacks to execute unauthorized code or commands. CISA added the flaw, a path traversal issue with a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog, urging urgent patching.

Why it matters：A critical, actively exploited flaw in widely deployed email security appliances forces organizations to patch immediately, and its addition to CISA's KEV catalog signals broad exposure across government and enterprise networks.

Key points

  • CVE-2026-104286 is a critical path traversal flaw allowing unauthenticated arbitrary file writes.
  • CISA added it to the KEV catalog following reports of active exploitation.
  • The flaw could let attackers write arbitrary files to vulnerable systems.

Sources (original reporting)

More stories from this day