FortiMail Zero-Day Under Active Exploitation

Fortinet disclosed a critical FortiMail zero-day (CVE-2026-104286, CVSS 9.8) being actively exploited in the wild; the unauthenticated path traversal/NULL-byte flaw affects FortiMail 7.2/7.4/7.6/8.0 branches, allows arbitrary file writes that can lead to code execution, and has no widespread fixed builds yet—CISA added it to the KEV catalog with an Oct 4, 2026 remediation date. Fortinet published host-based IOCs (file hashes, modified binaries, ld.so.preload, example logs) and two primary mitigations (disable IBE or remove management interface from the internet); organizations are advised to inventory appliances, contain internet-facing management, triage for compromise, rotate exposed secrets, and install vendor fixes once released.