Fortinet FortiMail Zero-Day Actively Exploited, Urgent Action Needed

A critical zero-day vulnerability in Fortinet’s FortiMail email security appliance, tracked as CVE-2026-104286, is being actively exploited in the wild, prompting urgent warnings from the US Cybersecurity and Infrastructure Security Agency (CISA) and Fortinet itself.

The flaw, which carries a maximum CVSS score of 9.8 (Critical), is a path traversal and improper neutralisation of NULL byte or NULL character vulnerability. It could allow attackers to write arbitrary files to the underlying system via crafted HTTP or HTTPS requests, potentially leading to remote code or command execution (RCE).

Urgent Mitigation and Patch Plans

Fortinet discovered the security defect internally and has released an advisory urging customers to implement immediate workarounds. These include disabling the IBE (Identity Based Encryption) feature support or restricting access to the FortiMail management interface from the web, limiting it only to trusted sources.

The company has also published indicators of compromise (IoCs) to assist security teams in detecting potential intrusions.

CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies address the issue within three days, in line with Binding Operational Directive (BOD) 26-04.

Affected versions of FortiMail include 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1.

Despite the active exploitation, patches have yet to be released. Fortinet has stated that fixes will be included in upcoming FortiMail versions 7.4.9, 7.6.7, and 8.0.2, but has not provided a specific release timeline. Neither Fortinet nor CISA has publicly disclosed details regarding the nature or scope of the observed attacks.