FortiMail Zero-Day Vulnerability Exploited in the Wild

By Editorial Team | October 5, 2026
A FortiMail zero-day vulnerability lets attackers write files with no login. Exploited now; fixes for 7.4, 7.6 and 8.0 were pending at disclosure.

A FortiMail zero-day vulnerability, CVE-2026-104286 (CVSS 9.8), lets an unauthenticated attacker write arbitrary files onto Fortinet’s email security appliance with nothing more than crafted web requests. Fortinet confirmed active exploitation on October 1, CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, and fixed releases for the 7.4, 7.6 and 8.0…

Read More