Critical Forti Mail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Summary: CISA added CVE-2026-104286, a FortiMail flaw rated CVSS 9.8, to its Known Exploited Vulnerabilities catalog on Thursday after reports of active exploitation. Fortinet said the path traversal (CWE-22) and NULL byte (CWE-158) issues let an unauthenticated attacker write arbitrary files via crafted HTTP or HTTPS requests, and it credited Gwendal Guégniaud of its Product Security team with finding and reporting the flaw.
Bottom line: An unauthenticated file-write on a mail gateway needs no credentials and no user action, and FCEB agencies have until October 4, 2026 to patch or apply workarounds - a deadline that implies fixes are not yet available for every affected version.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-104286CVE-2026-76504CVE-2026-85102CVE-2026-88771CVE-2026-88772CVE-2026-93616CVE-2026-93952CVE-2026-94127
- Related
- ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats Cyber Risks ·Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026