Fortinet FortiMail bug exploited in the wild, added to CISA KEV list

The CVSS 9.8 bug — CVE-2026-104286 — was also added to the known exploited vulnerabilities (KEV) catalog yesterday by the Cybersecurity and Infrastructure Security Agency (CISA), which gave federal agencies until Oct.

1 warned that a path traversal vulnerability in Fortinet FortiMail was being exploited in the wild and urged customers to patch right away.

In its advisory, Fortinet said the bug lets an unauthenticated attacker write arbitrary files onto the underlying system through crafted web requests.

Security pros were concerned about this one because the Fortinet FortiMail management interface operates as the admin console for the appliance that filters an organization's email and decides what gets delivered, quarantined or blocked.

An attacker who controls the email gateway can see the mail flowing through it, collect credentials and password reset links, and change the filtering so their own phishing gets through.

Initial access brokers look for exactly this kind of foothold: a trusted device at the network edge that a ransomware affiliate or fraud crew can pick up later.” Seemant Sehgal, chief executive officer at BreachLock, said an unauthenticated path traversal allowing arbitrary file writes gives an attacker effective control of the appliance, which means they can plant a web shell, route email through attacker-controlled infrastructure, intercept administrator credentials, and use the gateway as a foothold into the broader network.

Sannikov explained that the list includes changes to ld.so.preload, a Linux mechanism that loads a library into every process on the system, along with an added liblog.so file and a modified web server configuration.

Sannikov, global research coordinator at iCounter, said the indicators of compromise Fortinet published show attackers are using it to dig into the enterprise.

Sannikov said that combination points to attackers setting up persistent access, so they can stay on the device after the initial intrusion.

This essentially gives threat actors control of part of an organization's security infrastructure, letting the attackers decide what’s allowed in, said Sannikov.