All news & advisories

Actively exploited October 2, 2026

CVE-2026-104286: Actively Exploited Vulnerability

CVE-2026-104286 CVSS 9.8 CISA KEV · actively exploited

Who it affects: See the summary below.
What to do: Patch immediately — prioritise internet-facing systems.

CVE-2026-104286: Fortinet FortiMail Path Traversal

CVSS Score: 9.8 (Critical)
Exploited: Yes (KEV Catalog)

Affected Products

Fortinet FortiMail 8.0.0 through 8.0.1
Fortinet FortiMail 7.6.0 through 7.6.6
Fortinet FortiMail 7.4.0 through 7.4.8
Fortinet FortiMail 7.2.0 through 7.2.9

Vulnerability Details

Path traversal vulnerability allowing unauthenticated attackers to write arbitrary files via crafted HTTP/HTTPS requests.

Remediation

Update to patched versions beyond affected ranges
Consult Fortinet PSIRT advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-175
Prioritize immediately given active exploitation and CRITICAL severity

Data as of October 2, 2026. Sources: nvd.nist.gov, fortiguard.fortinet.com, cisa.gov. Figures are pulled from public vendor and security data and refreshed automatically.

Back to all news & advisories