Critical FortiMail Flaw Lets Unauthenticated Attackers Write Arbitrary Files and Execute Code

Fortinet disclosed a critical FortiMail vulnerability (CVE-2026-104286, CVSS 9.8) enabling unauthenticated arbitrary file write via path traversal and NULL-byte bypass; attackers are actively exploiting exposed management interfaces. Fortinet provided affected versions, recommended upgrades and a temporary workaround (disable IBE), and listed observed IOCs (malicious files, modified paths, and suspicious IPs) — organizations should prioritize patching, restrict management access, and investigate for persistence and configuration changes.