Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Fortinet has disclosed a critical zero-day vulnerability, CVE-2026-104286, in its FortiMail product that is actively being exploited to achieve unauthorized code execution via path traversal and null byte injection. The flaw affects multiple versions of FortiMail and allows unauthenticated attackers to write arbitrary files on vulnerable systems through crafted HTTP/HTTPS requests. Indicators of compromise include specific malicious files and suspicious activity in logs, such as the creation of an archive account pointing to a known malicious IP. Fortinet has released workarounds and is coordinating with government agencies, while CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog with a mitigation deadline for federal agencies.

AI-extracted · verify before operational use