Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CISA added Fortinet FortiMail flaw CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on Thursday after reports of active exploitation. The critical vulnerability, rated CVSS 9.8, allows unauthenticated attackers to write arbitrary files on the underlying system. Fortinet has not yet released a patch, and CISA urges organizations to apply mitigations or discontinue use until fixes are available.