Skip to contentistheinternetok
All incidents

Security flaw·Major

FortiMail mail servers: exploited flaw lets attackers in

Fix availableAttackers already use itAffects website owners
FortiMail (8.0, 7.6, 7.4, 7.2)

What it changes for you

Nothing visible for you; companies must update their mail servers.

A flaw in Fortinet's FortiMail email security servers lets anyone on the internet write files on the server, and attackers already use it. It matters to companies running FortiMail, not to individuals.

Started Oct 1, 2026Updated Oct 7, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Upgrade FortiMail to 8.0.2, 7.6.7 or 7.4.9 (7.2 users move to 7.4 or later). Until then, disable the IBE service or keep webmail off the internet, and check the systems for signs of compromise. FortiMail Cloud is already patched.

What is affected

CVE-2026-104286Severity score 9.8 out of 10

Timeline

  1. Fix available · Oct 5, 2026

    Fixed versions 8.0.2, 7.6.7 and 7.4.9 are out, and FortiMail Cloud is patched.

    Fortinet

  2. Identified · Oct 1, 2026

    CISA adds CVE-2026-104286 to its Known Exploited Vulnerabilities catalog.

    CISA

  3. Identified · Oct 1, 2026

    Fortinet publishes CVE-2026-104286, a path traversal in FortiMail that needs no login, and says it is already exploited. No fix yet; a workaround is given.

    Fortinet

Sources