CISA Warns of Critical FortiMail RCE Vulnerability, Actively Exploited

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert for a Fortinet FortiMail vulnerability (CVE-2026-104286) due to active exploitation.
• This remote code execution (RCE) flaw impacts Fortinet’s email security product, FortiMail, often deployed at network perimeters.
• An unauthenticated attacker can exploit the vulnerability by sending specially crafted HTTP/HTTPS requests, potentially achieving arbitrary file write access on the underlying system.
• CISA has mandated a remediation deadline for federal agencies and recommends immediate action for all affected organizations.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Fortinet FortiMail vulnerability, identified as CVE-2026-104286, to its authoritative Known Exploited Vulnerabilities (KEV) catalog. This inclusion comes after confirmed instances of the flaw being actively exploited in the wild.

The vulnerability targets Fortinet FortiMail, an email security solution widely utilized at network perimeters to safeguard enterprise messaging systems by filtering out malicious email traffic.

Exploitation of this issue is possible by an unauthenticated remote attacker who can send specially crafted HTTP or HTTPS requests to a vulnerable FortiMail appliance. Successful exploitation could grant the attacker the ability to write arbitrary files to the underlying operating system.

CVE-2026-104286 is categorized as a path traversal vulnerability, stemming from improper NULL-byte neutralization. This weakness allows attackers to manipulate file paths, enabling them to access or write files outside their intended directories.

Fortinet FortiMail 0-day Vulnerability Exploitation

The underlying cause, improper handling of NULL-bytes, can allow attackers to bypass input validation controls that rely on correctly processed file names or extensions. This vulnerability is associated with common weakness enumerations CWE-22 (Path Traversal) and CWE-158 (Improper Neutralization of Null Byte in Data Structure).

CISA officially listed this vulnerability in its KEV catalog on October 1, 2026. Federal civilian executive branch agencies are under a strict directive to remediate this issue by October 4, 2026, aligning with Binding Operational Directive 26-04, which prioritizes security updates based on risk levels.

Although CISA’s KEV entry for CVE-2026-104286 does not explicitly link the flaw to ransomware campaigns, the exploitation of internet-facing email security appliances like FortiMail could offer threat actors high-impact initial access points into organizational networks.

Gaining arbitrary file-write access could potentially enable malicious actors to deploy malware, alter system configurations, establish persistent access, or prepare systems for further compromise. The exact impact would depend on the specific appliance configuration and existing file permissions.

CISA has also designated this issue as requiring forensic triage under BOD 26-04. Organizations operating FortiMail deployments are urged to identify all exposed devices, verify their vulnerability status, apply Fortinet’s recommended mitigations or security updates, and meticulously review logs for any suspicious HTTP or HTTPS requests.

Security teams should additionally investigate for any unexpected files, unauthorized changes to system configurations, newly created or modified user accounts, and unusual outbound network activity that might indicate compromise.

In scenarios where an effective mitigation or security update is not immediately available, CISA advises stakeholders to either follow applicable guidance for cloud services or cease the use of the affected product until a resolution can be implemented.

Prioritization should be given to FortiMail deployments that are directly accessible from the internet, as their external exposure significantly increases the likelihood of opportunistic scanning and exploitation by threat actors.

What You Should Do

• Immediately identify all Fortinet FortiMail appliances within your environment, especially those exposed to the internet.
• Verify if your FortiMail versions are affected by CVE-2026-104286.
• Apply all available security updates or vendor-recommended mitigations from Fortinet without delay.
• Conduct a thorough review of HTTP and HTTPS request logs for any suspicious activity, particularly around the time CISA issued its alert.
• Perform a forensic triage: inspect for unexpected files, unauthorized configuration changes, new user accounts, or unusual outbound network connections.
• If a patch or mitigation is unavailable, consider temporarily isolating or discontinuing the use of affected FortiMail products until a secure solution can be implemented.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.