Fortinet has warned customers that attackers are actively exploiting a critical zero-day vulnerability in its FortiMail email security platform, and no permanent patch is available yet.
The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 out of 10, placing it near the top of the severity scale. Fortinet disclosed it in security advisory FG-IR-26-175 on October 1 and confirmed it is already being exploited in the wild.
The vulnerability was discovered internally by Gwendal Guegniaud of Fortinet's Product Security team.
What the flaw lets attackers do
Fortinet describes the bug as a combination of path traversal and improper handling of null bytes in FortiMail's web interface. An unauthenticated attacker can send specially crafted HTTP or HTTPS requests and write arbitrary files to the underlying operating system — no login required.
Writing files to certain locations could allow an attacker to execute code or commands on the appliance.
The target makes the flaw especially serious. FortiMail is an email security gateway designed to protect organizations against spam, malware and phishing, so it sits at the boundary of every email flowing in and out of a company.
A compromised gateway is not just a device compromise; it is a foothold at the front door of corporate communications, where an attacker could intercept or manipulate sensitive traffic.
Who is exposed, and what to do about it
The flaw affects multiple supported FortiMail branches: versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet says fixes are being prepared in versions 8.0.2, 7.6.7 and 7.4.9, but those releases are still listed as upcoming.
Users of the 7.2 branch are advised to move to the 7.4 branch or later.
Until the patches land, Fortinet recommends workarounds: disabling Identity-Based Encryption (IBE) support through the appliance's command line, and keeping the FortiMail management interface off the internet — restricting access to trusted private networks only.
Internet-exposed management interfaces are the particular concern, since the vulnerable functionality is reached through the product's web interface.
CISA raises the alarm
The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on October 1, directing federal civilian agencies to carry out forensic triage and apply mitigations by October 4 — a three-day window.
Fortinet has also published indicators of compromise, including suspicious files and configuration changes along with attacker-associated IP addresses, for administrators to hunt for on their systems.
Fortinet has not said how many appliances have been compromised, when the attacks began, or who is behind the activity.
Organizations running affected versions should treat exposure as urgent: check whether their management interfaces are reachable from the internet, review the published indicators, and apply the workarounds while waiting for the permanent fixes.
