Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CISA added a critical Fortinet FortiMail vulnerability (CVE-2026-104286, CVSS 9.8) to its Known Exploited Vulnerabilities list after active exploitation was reported; the flaw enables unauthenticated arbitrary file writes via path traversal and NULL-byte handling. Fortinet published affected versions and recommended upgrades/workarounds (disable IBE, restrict management access) and provided IOCs (two IPs and several files added/modified); FCEB agencies were advised to patch or mitigate by October 4, 2026.