FortiMail Zero-Day Vulnerability (CVE-2026-104286)

The Threat

On October 1st, 2026, Fortinet disclosed a critical zero-day vulnerability impacting multiple versions of FortiMail. Fortinet has confirmed active exploitation prior to patch disclosure.

The vulnerability, tracked as CVE-2026-104286 (CVSS: 9.8), allows unauthenticated threat actors to write arbitrary files via crafted HTTP or HTTPS requests. Exploitation allows for unauthenticated code execution on the underlying system.

At the time of writing, security patches have been released for one of the four impacted versions. As exploitation is ongoing, it is critical that organizations apply the available security patches or alternative mitigations immediately.

What we're doing about it

• eSentire's Threat Response Unit (TRU) is performing threat hunts across customer environments for known Indicators of Compromise (IoCs)
• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• TRU is tracking this topic for additional information and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches immediately
  • Monitor Fortinet official sources for outstanding security patch releases
• In cases where patching is not possible, Fortinet recommends disabling the Identity-Based Encryption (IBE) feature support
• Access to the FortiMail management interface should be limited to trusted networks only
• Investigate the Indicators of Compromise (IoCs) made available by Fortinet in the official vulnerability disclosure

Additional information

CVE-2026-104286 is due to a combination of a path traversal flaw and the improper neutralization of NULL bytes or NULL characters. It was discovered internally by the Fortinet Product Security team. The vulnerability is highly concerning as it could enable initial access into organizations, and a variety of other malicious actions including the deployment of additional tools. All potentially impacted devices should be reviewed for signs of compromise, as patching or applying recommended mitigations will not remove previously established persistence mechanisms. Fortinet has provided a short list of IoCs for hunting purposes.

While Fortinet states that the company is aware of reported exploitation, no additional details on real-world attacks were provided. CISA added validity to the exploitation claim on October 1st by adding CVE-2026-104286 to the Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch (FCEB) agencies have been given a short patch window, requiring remediation by October 4th.

References:

[1] https://fortiguard.fortinet.com/psirt/FG-IR-26-175
[2] https://www.cve.org/CVERecord?id=CVE-2026-104286
[3] https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog
[4] https://www.cisa.gov/known-exploited-vulnerabilities-catalog