Fortinet and CISA confirm exploitation of an unauthenticated FortiMail arbitrary-file-write flaw. Fixed builds were still unavailable at disclosure, making isolation, feature-level mitigation and forensic triage today’s highest-priority decision.
What changed
CVE-2026-104286 allows unauthenticated arbitrary file writes through crafted HTTP or HTTPS requests to affected FortiMail appliances. Fortinet published appliance indicators and temporary mitigations, while CISA added the flaw to KEV and set a short federal deadline.
Public record through 2026-10-02. Source references count citations across published briefings, including repeated sources. Explore the record and its limits →
What We Publish / What We Sell
D
Free · Public
The Daily
Five evidence-backed selections for security leaders, every weekday.
Scores are Security.io editorial assessments from 0–100. Exposure reflects reachable affected estate, Urgency reflects exploitation and fix availability, and Business Consequence reflects mail-gateway privilege and compromise cost. Exposure: 82. Urgency: 98. Business consequence: 91. Focus the chart and use the up and down arrow keys for detail. Source: Security.io editorial score using Fortinet PSIRT and CISA KEV evidence.