Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) - Help Net Security
Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway.
Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway.
Fortinet says the flaw has been reported to be exploited in the wild, and urges customers to apply the workaround it shared until fixes are available.
the company said in a security advisory published on October 1, 2026.
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog the same day, and gave US federal civilian agencies until October 4, 2026, to address it.
The vulnerability, with a CVSSv3 score of 9.8, was discovered internally by Gwendal Guégniaud of the company’s Product Security team.
Fortinet will fix it in versions 8.0.2, 7.6.7 and 7.4.9, which have not been released, and advises 7.2 users to upgrade to the 7.4 branch or above.
Until the patch is available, customers can disable support for IBE, FortiMail’s identity-based encryption feature, with these CLI commands: Alternatively, administrators can block internet access to the management interface or restrict it to a trusted private network.
Fortinet did not share details about when or where the attacks were spotted, how many systems were compromised, or who was behind them.
Fortinet’s researchers have also shared the files, IP addresses and log entries tied to the attacks so that administrators can check whether their FortiMail appliances have been compromised.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
Fortinet has acknowledged that the vulnerability has been exploited in the wild, urging customers to apply the following workarounds until fixes are available for certain versions - Fortinet credited Gwendal Guégniaud of the Fortinet Product Security team with discovering and reporting the flaw.
It has shared the following indicators of compromise - In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patch or workarounds by October 4, 2026.
The development comes as number of security flaws in Check Point (CVE-2026-85102 and CVE-2026-93616), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP Access Policy Manager (CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), and Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) have come under in-the-wild exploitation.
What happened
Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway.
Fortinet says the flaw has been reported to be exploited in the wild, and urges customers to apply the workaround it shared until fixes are available.
the company said in a security advisory published on October 1, 2026.
What changed
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog the same day, and gave US federal civilian agencies until October 4, 2026, to address it.
The vulnerability, with a CVSSv3 score of 9.8, was discovered internally by Gwendal Guégniaud of the company’s Product Security team.
Fortinet will fix it in versions 8.0.2, 7.6.7 and 7.4.9, which have not been released, and advises 7.2 users to upgrade to the 7.4 branch or above.
Who is affected
Until the patch is available, customers can disable support for IBE, FortiMail’s identity-based encryption feature, with these CLI commands: Alternatively, administrators can block internet access to the management interface or restrict it to a trusted private network.
Fortinet did not share details about when or where the attacks were spotted, how many systems were compromised, or who was behind them.
Why it matters
Fortinet’s researchers have also shared the files, IP addresses and log entries tied to the attacks so that administrators can check whether their FortiMail appliances have been compromised.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
Technical details
The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
Fortinet has acknowledged that the vulnerability has been exploited in the wild, urging customers to apply the following workarounds until fixes are available for certain versions - Fortinet credited Gwendal Guégniaud of the Fortinet Product Security team with discovering and reporting the flaw.
It has shared the following indicators of compromise - In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patch or workarounds by October 4, 2026.
Response
The development comes as number of security flaws in Check Point (CVE-2026-85102 and CVE-2026-93616), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP Access Policy Manager (CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), and Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) have come under in-the-wild exploitation.
As a single-pane-of-glass used by enterprises to manage, configure, and monitor large networks, it’s naturally an attractive target.” Roman Sannikov, global research coordinator at iCounter, said because Cisco’s SD-WAN Manager controls how traffic moves between every branch on the network, teams need to patch quickly.
What security teams should do
What should actually change is treating internet-facing management interfaces as the crown jewels they are: restrict access to known, trusted sources, put them behind a layer that can detect and block anomalous API requests in real time, and assume a patch will always be late to at least some of your fleet.” Jason Soroko, senior fellow at Sectigo, added that this bypass grants administrator access to the central manager’s API, creating a risk of unauthorized configuration changes across the branches it manages.
Soroko said Cisco teams should patch and investigate possible compromise, also preserve logs before upgrading, check for unexpected access, and review configuration changes.
What remains unknown
Two log files are the places to look for j_security_check entries from unknown or unauthorized IP addresses: Names starting with viptela-reserved- belong to reserved system service accounts.
Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe.
That said, it's unclear how many of them are vulnerable to either of the two flaws.
Attribution
Help Net Security: Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway.
The Hacker News: The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
SC Media: The Cybersecurity and Infrastructure Security Agency (CISA) added a critical CVSS 9.8 authentication bypass flaw in Cisco Catalyst SD-WAN Manager to its known exploited vulnerabilities (KEV) catalog on Sept. 30.
The Hacker News: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities ( KEV ), following reports of active exploitation.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.