Fortinet FortiMail mitigation guidance for CVE-2026-104286
Advisory/Mitigation
Summary
Hide ▲
Show ▼
Fortinet issued mitigation guidance for CVE-2026-104286 in FortiMail, warning administrators to use workarounds while the flaw is being actively exploited. The advisory tells customers to disable IBE support or restrict management access to trusted private networks until a security update is available. The guidance applies to FortiMail 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Fortinet says fixed builds are coming in 7.4.9, 7.6.7, and 8.0.2, and 7.2 users can move to the 7.4 branch or later.
Related Happenings
Atlassian Data Center products path traversal (CVE-2026-21589)
Vulnerability
H score32
First: 06.10.2026 09:58
Last: 06.10.2026 09:58
Sources 1
About this happening:
Atlassian disclosed CVE-2026-21589, a path traversal vulnerability in 8 self-hosted Data Center products that can let a no-login attacker read specific files in ea...
Atlassian Data Center products path traversal (CVE-2026-21589)
VulnerabilityAbout this happening: Atlassian disclosed CVE-2026-21589, a path traversal vulnerability in 8 self-hosted Data Center products that can let a no-login attacker read specific files in ea...
CISA KEV mandate for FortiMail CVE-2026-104286
Public Sector Action
H score32
First: 02.10.2026 01:42
Last: 02.10.2026 01:42
Sources 1
How related:
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.
About this happening:
CISA added CVE-2026-104286 to the Known Exploited Vulnerability catalog and required federal agencies to perform forensic triage and mitigate the FortiMail fla...
CISA KEV mandate for FortiMail CVE-2026-104286
Public Sector ActionHow related: The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.
About this happening: CISA added CVE-2026-104286 to the Known Exploited Vulnerability catalog and required federal agencies to perform forensic triage and mitigate the FortiMail fla...
FortiMail actively exploited path traversal and NULL-byte flaw (CVE-2026-104286)
Vulnerability
H score43
First: 02.10.2026 01:42
Last: 02.10.2026 01:42
Sources 1
How related:
The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
About this happening:
Fortinet FortiMail is facing an actively exploited CVE-2026-104286 flaw that lets unauthenticated attackers write arbitrary files and run unauthorized code on vulnerable d...
FortiMail actively exploited path traversal and NULL-byte flaw (CVE-2026-104286)
VulnerabilityHow related: The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
About this happening: Fortinet FortiMail is facing an actively exploited CVE-2026-104286 flaw that lets unauthenticated attackers write arbitrary files and run unauthorized code on vulnerable d...
FortiSandbox unauthenticated command injection (CVE-2026-25089)
Vulnerability
H score47
First: 16.06.2026 13:30
Last: 16.06.2026 13:30
Sources 1
About this happening:
CVE-2026-25089 is an unauthenticated operating system command injection in FortiSandbox-related products that was seen in active exploitation over the past 24 ho...
FortiSandbox unauthenticated command injection (CVE-2026-25089)
VulnerabilityAbout this happening: CVE-2026-25089 is an unauthenticated operating system command injection in FortiSandbox-related products that was seen in active exploitation over the past 24 ho...
Latest development: 17.07.2026 10:03
CISA ordered U.S. federal agencies to prioritize patching CVE-2026-39808 and CVE-2026-25089 in Fortinet FortiSandbox after confirming both flaws are actively exploited in the wild, with vulnerable FortiSandbox instances subject to a Sunday, July 19 patch deadline under BOD 26-04.
Fortinet FortiSandbox multi-CVE exploitation wave
Exploitation Wave
H score49
First: 16.06.2026 12:19
Last: 16.06.2026 12:19
Sources 1
About this happening:
Fortinet FortiSandbox is facing an active exploitation wave that puts affected deployments at risk of unauthenticated remote code execution and privilege escalat...
Fortinet FortiSandbox multi-CVE exploitation wave
Exploitation WaveAbout this happening: Fortinet FortiSandbox is facing an active exploitation wave that puts affected deployments at risk of unauthenticated remote code execution and privilege escalat...
Timeline
-
02.10.2026 01:42 3 articles · 12d ago
Fortinet warns of active zero-day exploitation in CVE-2026-104286
Initial DisclosureFortinet warns FortiMail customers that CVE-2026-104286 is a critical FortiMail management-interface flaw with a CVSS score of 9.8 that is being actively exploited in zero-day attacks to execute unauthorized code or commands, with an unauthenticated attacker able to write arbitrary files via crafted HTTP or HTTPS requests. The advisory says the issue affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9, recommends disabling IBE feature support or restricting management access to trusted private networks, lists upcoming fixes in FortiMail 7.4.9, 7.6.7, and 8.0.2, publishes indicators of compromise tied to compromised systems, and notes that CISA added the flaw to the Known Exploited Vulnerability catalog.
Show sources
- Fortinet warns of critical FortiMail flaw exploited in zero-day attacks — www.bleepingcomputer.com — 02.10.2026 01:42
- Fortinet warns of critical FortiMail flaw exploited in zero-day attacks — www.bleepingcomputer.com — 02.10.2026 01:42
- Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes — thehackernews.com — 02.10.2026 08:49