Our takeCISA added CVE-2026-104286 to KEV: unauthenticated path-traversal + NULL-byte flaw in FortiMail that lets attackers write arbitrary files. Patch or apply the vendor workaround now if you run FortiMail.Security Resilience desk
Sources (6)
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- bleeping · bleeping
- cisa_advisories · cisa_advisories
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
What this means for you — Security leader:CISA added CVE-2026-104286 (FortiMail path traversal allowing unauthenticated arbitrary file writes) to KEV. Apply the vendor patch or mitigations immediately if you run FortiMail.
What this means for you — Lean IT orgs:If you run FortiMail, install the update from Fortinet right away. This vulnerability is already being exploited in the wild.
What this means for you — MSP:Check every client running FortiMail and apply the patch for CVE-2026-104286 immediately; it is confirmed exploited in the wild.
What this means for you — Researcher:CISA added CVE-2026-104286 (FortiMail path traversal + NULL-byte flaw allowing unauthenticated arbitrary file writes) to KEV based on confirmed in-the-wild exploitation.