A critical Fortinet FortiMail vulnerability that is already being exploited in the wild should be patched immediately, security researchers warned, after the flaw was added to the United States' list of known exploited vulnerabilities. The flaw, tracked as CVE-2026-104286, carries a CVSS severity score of 9.8 out of 10.

The vulnerability is an improper limitation of a pathname to a restricted directory, commonly called path traversal, in FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. It may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests, according to the vulnerability description recorded in the US National Vulnerability Database.

Why the urgency

The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue on 1 October 2026, meaning there is reliable evidence of attacks in the wild. US federal agencies were required to fix it by 4 October 2026, a deadline that has now passed. That deadline does not bind anyone else, but it shows how seriously the agency rates the flaw.

The EPSS model estimates a 2.2 percent probability that the flaw will be exploited somewhere in the next 30 days, higher than 82 percent of all scored vulnerabilities. Administrators should check their FortiMail version against Fortinet's advisory FG-IR-26-175, apply the fixed release, and check internet-facing systems for signs of compromise, since patching alone does not remove any access an attacker may already have gained.

Source: 2-Spyware CVE briefing, updated 25 October 2026, citing the Fortinet advisory FG-IR-26-175 and the CISA catalogue entry.