Critical Fortinet Zero-Day Exploited in the Wild: CISA Demands Immediate FortiMail Patch

The Cybersecurity and Infrastructure Security Agency (CISA) added a critical Fortinet FortiMail vulnerability to its Known Exploited Vulnerabilities catalog following active in-the-wild exploitation. Tracked as CVE-2026-104286 with a 9.8 CVSS score, the zero-day flaw allows unauthenticated remote attackers to execute arbitrary file writes on the host system. The exploit relies on an improper path traversal limitation and a failure to neutralize NULL characters in crafted HTTP or HTTPS requests. CISA has issued an October 4, 2026 deadline for Federal Civilian Executive Branch agencies to apply the necessary patches or workarounds. "An improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] and improper neutralization of NULL byte or NULL character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests." — Fortinet