CVE-2026-104286: FortiMail Unauthenticated Arbitrary File Write Zero-Day Under Active Exploitation

**FortiMail CVE-2026-104286 (CVSS 9.8) is a critical, actively exploited unauthenticated arbitrary file write vulnerability in the Identity‑Based Encryption handler that allows an attacker to write attacker-controlled files anywhere on the appliance filesystem; Fortinet published advisory FG-IR-26-175 and CISA added the CVE to its KEV on Oct 1, 2026 (three-day federal mitigation deadline).** Immediate actions recommended are disabling IBE, applying fixed releases (7.4.9, 7.6.7, 8.0.2 or later; 7.2 requires migration), and performing forensic triage using provided IoCs (file paths, hashes, IPs, account and cron artifacts) while relying on external logs because local logs may be tampered with.