Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CISA has added a critical Fortinet FortiMail vulnerability (CVE-2026-104286) to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. The flaw carries a CVSS score of 9.8 and allows unauthenticated attackers to write arbitrary files on the underlying system. The vulnerability is classified as an improper file write issue. Its presence in the KEV catalog indicates it is being actively leveraged in real-world attacks. Organizations using FortiMail are urged to apply patches or mitigations promptly. The zero-day nature of the flaw means it was exploited before a patch was widely available. This follows a pattern of threat actors targeting Fortinet products for initial access and persistence.