FortiMail flaw faces active exploitation while fixes remain unavailable

Fortinet says attackers are exploiting CVE-2026-104286 in FortiMail, with no fixed build yet available across affected release branches. The vulnerability lets an attacker without authentication send crafted HTTP or HTTPS requests that write arbitrary files to the system, potentially enabling unauthorized code or command execution. Affected versions include 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, and 7.4.0 through 7.4.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog, setting an Oct. 4 remediation deadline for U.S. federal civilian agencies. Fortinet recommends disabling IBE feature support and restricting management access to trusted private networks. It has also published indicators of compromise. These mitigations reduce exposure but do not repair the vulnerable code.