FortiMail: an exploited critical flaw puts email servers under pressure

A vulnerability rated critical

Fortinet FortiMail, a solution designed to secure email infrastructure, is affected by a vulnerability tracked as CVE-2026-104286. The flaw is rated critical, with a CVSS score of 9.8 out of 10.

It affects the following versions in particular:

• FortiMail 7.2.0 to 7.2.9;
• FortiMail 7.4.0 to 7.4.8;
• FortiMail 7.6.0 to 7.6.6;
• FortiMail 8.0.0 to 8.0.1.

The problem is a path traversal vulnerability, combined with incorrect handling of NULL characters. In practice, a specially crafted request can allow an unauthenticated attacker to write files on the affected system. That is exactly what makes this vulnerability so worrying: the attacker does not need a valid account on the system beforehand.

The flaw is already being exploited

The most important point of this alert is not just the theoretical severity of the vulnerability. It is already being exploited in the wild. Fortinet says the vulnerability is being actively exploited. This information has also been relayed by the Canadian Centre for Cyber Security. The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalogue on 1 October 2026. This catalogue lists vulnerabilities for which CISA has evidence of exploitation by malicious actors.

Why FortiMail is particularly sensitive

FortiMail is used as a security solution for email environments. Its very job is to filter and protect email communications against a range of threats: spam, phishing, malware, account compromise and targeted attacks. This means that a compromise of the email security infrastructure can have serious consequences. A compromised mail server could, for example, become an additional entry point into the information system. It is important, however, to distinguish the vulnerability itself from its potential consequences: the available sources confirm that arbitrary files can be written, but they do not show that every vulnerable installation has been compromised.

Who should check their infrastructure?

This alert mainly concerns organisations using FortiMail in their email infrastructure. Administrators should in particular check:

• 1. The version currently installed:
• 2. The exposure of the administration interface
• 3. The logs
• 4. The mitigation measures

What to do in the meantime?

The first step is to quickly identify the equipment concerned. If your organisation uses FortiMail, don’t just check whether the server is running normally. You need to check:

• the FortiMail version;
• internet exposure;
• security logs;
• administrator accounts;
• unusual connections;
• Fortinet’s recommendations;
• any indicators of compromise provided by the vendor.

CISA recommends that organisations handle the vulnerabilities in its KEV catalogue as a priority as part of their risk management. The Canadian Centre for Cyber Security also advises administrators to consult the vendor’s resources and apply the necessary measures.

Another illustration of AI’s role in cybersecurity

This alert comes as cybersecurity players are seeing an acceleration of AI-assisted attacks. The day before, Thales CEO Patrice Caine called for stronger AI-based defences to counter attacks that can be carried out faster and on a larger scale. Reuters also reports that Thales is developing new tools to defend against AI-assisted attacks. The landscape is therefore shifting in both directions: AI can help attackers speed up some operations, but it is also becoming a defensive tool for detecting and responding to threats.

What to remember

CVE-2026-104286 is not just a theoretical flaw. It is rated critical, it affects several versions of FortiMail, and cybersecurity agencies confirm that it is being actively exploited. Organisations using FortiMail should therefore check their version, review the exposure of their infrastructure and apply the security measures recommended by Fortinet. For system and network administrators, the message is simple: