Attackers are planting files through an actively exploited FortiMail flaw

Fortinet’s 1 October PSIRT advisory says attackers are actively exploiting CVE-2026-104286 in FortiMail. NVD’s record, based on information from Fortinet, describes a path-traversal issue that can let an unauthenticated attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. Fortinet assigned a CVSS 3.1 score of 9.8.

France’s CERT-FR separately lists the risk as remote code execution and says the vendor published indicators of compromise. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 1 October, requiring federal agencies to apply mitigations by 4 October.

Administrators should use Fortinet’s advisory for the fixed release that matches their FortiMail branch and review the vendor’s indicators. Public version summaries differ in how they represent some affected branches, so this article does not reproduce a single version cutoff. The Fortinet advisory is the source for current remediation instructions.

Active exploitation and a serious file-write capability do not establish that a particular FortiMail customer was breached. Neither Fortinet nor CERT-FR names affected organizations or reports a victim count in the cited notices.