Cybersecurity
CISA adds FortiMail flaw to exploited vulnerabilities list
CISA added a Fortinet FortiMail flaw to its exploited vulnerabilities list after reports of active abuse, while Fortinet issued workaround guidance, upgrade paths and indicators of compromise.
- CISA added CVE-2026-104286 affecting Fortinet FortiMail to its Known Exploited Vulnerabilities catalog on Thursday after reports of active exploitation.
- Fortinet said the issue could let an unauthenticated attacker write arbitrary files on the system through crafted HTTP or HTTPS requests.
- Fortinet said the flaw affected FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9.
- Fortinet said it had been exploited in the wild, published workarounds and listed indicators of compromise including two IP addresses and several files.
- CISA recommended that Federal Civilian Executive Branch agencies patch the issue or apply the workarounds by 4 October 2026.
CISA added CVE-2026-104286, a Fortinet FortiMail flaw, to its Known Exploited Vulnerabilities catalogue after reports that it had been used in attacks. Fortinet said the weakness could allow an unauthenticated attacker to write files on the underlying system by sending crafted HTTP or HTTPS requests.
Fortinet said the affected releases were FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9. It advised customers to move to the listed fixed versions or, where fixes were not yet available, to disable IBE support and block internet access to the management interface or limit it to trusted private networks.
The company said the flaw had been exploited in the wild and published indicators of compromise. These included the addresses 79.141.169[.]187 and 45.129.0[.]192, together with several added or modified files such as /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload, /bin/smit, /data/etc/httpd.conf and /data/migadmin.tar.gz.
Fortinet credited Gwendal Guégniaud of its Product Security team with finding and reporting the issue. CISA told Federal Civilian Executive Branch agencies to apply the patch or the workarounds by 4 October 2026, and the article said several other products from Check Point, Arista VeloCloud Orchestrator, F5, Cisco and Citrix were also under in-the-wild exploitation.
Named in this story
People
- Gwendal Guégniaud
- was credited with discovering and reporting the flaw
Companies
- Fortinet
- issued the advisory and mitigation guidance
Organisations
- Fortinet Product Security team
- received credit for the discovery report
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the flaw to its Known Exploited Vulnerabilities catalog
- Federal Civilian Executive Branch
- was told to patch or use workarounds by 4 October 2026
Products and systems
- FortiMail
- was the affected email security product
- CVE-2026-104286
- was the flaw tracked in the report
How the source tells it
A plain security advisory with factual urgency from active exploitation and a patch deadline.
No emotive framing was found in the original.