CISA adds FortiMail CVE-2026-104286 to KEV after confirmed in-wild path traversal exploitation

Fortinet disclosed the zero-day internally discovered across FortiMail 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6 and 8.0.0-8.0.1. The flaw combines path traversal with NULL byte neutralization failure, enabling arbitrary file writes via crafted HTTP or HTTPS requests and subsequent code execution. No patches exist; workarounds are limited to disabling IBE or restricting management interface access. Fortinet released IoCs but withheld observed attack details.

CISA’s KEV listing aligns with a documented pattern of email platform zero-days receiving rapid cataloging once exploitation evidence surfaces, matching prior entries for Zimbra and NetScaler appliances. Procurement records show FortiMail deployments concentrated in government and finance verticals, increasing blast radius. Absence of independent technical attribution leaves open whether observed activity matches state or criminal tooling.

Upcoming fixes in 7.4.9, 7.6.7 and 8.0.2 carry no release dates, leaving organizations reliant on network segmentation and logging. Contract awards indicate continued FortiMail purchases despite the gap, suggesting procurement cycles outpace patch cadence.

Next indicators will likely appear in CISA’s weekly KEV updates or Fortinet’s incident telemetry once patches ship.