Fortinet has warned that CVE-2026-104286, a critical FortiMail vulnerability, is being exploited in the wild. The flaw can let an unauthenticated attacker write arbitrary files on an affected system through crafted HTTP or HTTPS requests.
The vendor attributes the issue to path-traversal and null-byte handling weaknesses and has provided version-specific upgrade guidance. For versions without an immediately available fixed release, Fortinet recommends disabling IBE support and limiting management-interface access to trusted private networks.
Immediate actions
- Identify every exposed FortiMail appliance and compare its version to Fortinet’s advisory.
- Apply available fixes or the vendor’s temporary mitigations as appropriate.
- Restrict management access and review the vendor-provided indicators of compromise.
- Investigate unexpected changes to files, preload settings, web configuration, or new binaries.
Because exploitation is confirmed, organizations should treat this as an incident-response priority, not a routine patching item.
Source: The Hacker News summary; Fortinet advisory FG-IR-26-175.