FortiMail unauthenticated file-write zero-day CVE-2026-104286
› Fortinet FortiMail
- started
- Sep 30, 2026
- closed
- ongoing
- CVEs
- 1
- sources
- 5
## summary
Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).
severity: CVSS 9.8 (Critical); actively exploited / CISA KEV
## cve ids[1]
## affected
- 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, 8.0.0–8.0.1 (migrate/upgrade per Fortinet matrix)
## fixed in
- 8.0.2+
- 7.6.7+
- 7.4.9+; 7.2.x migrate to 7.4.9+
## timeline[2]
Fortinet PSIRT FG-IR-26-175 patches and mitigations.
Active exploitation and CISA alerts begin circulating.
## advisories[1]
## news & write-ups[1]
## posts[3]
fortinet is warning about a critical fortimail zero-day, cve-2026-104286, already under active exploitation. cisa has flagged it too. t.co/8phX4oRY7S it is an unauthenticated arbitrary file write, rated 9.8, triggered by a crafted http or https request.
🚨 Fortinet FortiMail: CVE-2026-104286 (CVSS 9.8) is actively exploited. Unauthenticated attackers can write arbitrary files, potentially leading to code execution. Your email security gateway needs security. Ironic. #Cybersecurity t.co/ldmxkOOdHO t.co/0AYMecEQPs
🛡️ CVE-2026-104286: escritura arbitraria de archivos en Fortinet FortiMail CISA confirma explotación activa de CVE-2026-104286, una falla crítica de FortiMail que permite escritura arbitraria de archivos sin autenticación. t.co/V275SQHfFe #ciberplaneta #vulnerabilidades
## notes & caveats
Slightly older than the core Oct 21 cluster but still in the 2–3 week window and on CISA KEV; included for operators running mail gateways.
