Critical FortiMail zero-day actively exploited and added to the KEV catalog

Fortinet has confirmed the active exploitation of CVE-2026-104286, a critical zero-day vulnerability in FortiMail email security gateways. The flaw, rated with a CVSS score of 9.8, combines path traversal and improper handling of NULL characters, allowing an unauthenticated attacker to write arbitrary files to the system through specially crafted HTTP or HTTPS requests. CISA immediately added the issue to the Known Exploited Vulnerabilities catalog, indicating a concrete rather than merely theoretical risk. CSIRT Italy also issued an alert about exploitation in the wild, while Fortinet urged customers to apply the available mitigation while awaiting corrective updates. Because FortiMail is deployed at the perimeter and handles potentially malicious email traffic, a compromise could provide attackers with a privileged entry point into corporate networks. Affected organizations should apply the workaround, check for unusual files or changes, and closely monitor exposed devices.

Source: Help Net Security