CISA Issues Urgent Alert on Exploited FortiMail Zero-Day
The US Cybersecurity and Infrastructure Security Agency (CISA) and Fortinet jointly issued a security alert on Thursday regarding a critical, actively exploited zero-day vulnerability in FortiMail email security appliances. The flaw, identified as CVE-2026-104286, carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to the potential for full system compromise.
Technical Details of CVE-2026-104286
The vulnerability stems from two combined weaknesses: a path traversal flaw and improper neutralization of NULL bytes or NULL characters. When exploited together, these flaws allow unauthenticated attackers to write arbitrary files to the underlying operating system of the FortiMail device. This capability can lead to arbitrary code or command execution, effectively granting attackers full control over the affected appliance.
Exploitation occurs through specially crafted HTTP or HTTPS requests targeting the FortiMail web interface. Fortinet confirmed that the attack vector does not require authentication, making remotely exploitable via network access to the management interface.
Fortinet Advises Workarounds Amid Missing Patches
Fortinet has released a security advisory detailing the vulnerability but emphasized that patches are not yet available. The company stated that fixes will be included in upcoming FortiMail releases: version 7.4.9, 7.6.7, and 8.0.2. However, no release timeline has been provided for these updates.
In the absence of patches, Fortinet urges organizations to implement immediate workarounds: disable the Identity-Based Encryption (IBE) feature if not required, or restrict access to the FortiMail management interface to trusted IP addresses only. Ideally, administrative access should be disabled from the web entirely and limited to internal, trusted networks.
“This has been reported to be exploited in the wild; customers are urged to apply the workaround,” Fortinet stated in its advisory.
CISA Adds Vulnerability to KEV Catalog with 3-Day Deadline
On the same day, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog. This designation mandates that federal civilian agencies apply mitigations or updates within three days, in accordance with Binding Operational Directive (BOD) 26-04, which requires timely remediation of actively exploited vulnerabilities.
CISA’s inclusion of the flaw in the KEV catalog underscores the likelihood of ongoing exploitation and the need for immediate action across all sectors, not just government entities.
Affected FortiMail Versions and Discovery Context
According to Fortinet, the vulnerability affects a broad range of FortiMail versions:
- 7.2.0 through 7.2.9
- 7.4.0 through 7.4.8
- 7.6.0 through 7.6.6
- 8.0.0 through 8.0.1
Versions outside these ranges, including 7.3.x and earlier 7.2.x releases prior to 7.2.0, are not believed to be impacted. Fortinet confirmed that the bug was discovered internally during its own security testing and was not reported by an external researcher or third party.
No Public Details on Observed Attacks
Neither Fortinet nor CISA has released specific details about the nature of the observed attacks, the threat actors involved, or the geographic or sectoral targeting of exploitation campaigns. The company did, however, publish indicators of compromise (IoCs) to assist security teams in detecting potential intrusion attempts related to this vulnerability.
As of the advisory date, no public exploit code has been linked to CVE-2026-104286, but the confirmed active exploitation warrants treating it as an imminent threat requiring immediate mitigation.
Source: SecurityWeek