CSA reports active exploitation of patched critical FortiMail flaw
Singapore's CSA warns that critical FortiMail flaw CVE-2026-104286, CVSS 9.8, is reportedly being actively exploited. The path traversal bug lets an unauthenticated attacker write files on the underlying system via crafted HTTP or HTTPS requests. Fortinet has released fixes (8.0.2+, 7.6.7+, 7.4.9+); update now and check IOCs.
What happened
Singapore's CSA has warned that attackers are actively exploiting a critical flaw in FortiMail, Fortinet's email security product. The flaw lets an attacker write files on the server without authentication. Fortinet has released patches for current versions.
Why it matters
Email is a core business channel and a top attack vector; a compromised FortiMail can halt messaging and expose the server. The flaw scores 9.8 out of 10 and CSA reports active exploitation, so unpatched systems face immediate risk.
What to do
Update immediately to FortiMail 8.0.2 or later, 7.6.7 or later, or 7.4.9 or later; 7.2.x installs require migration. Apply Fortinet's workarounds in the meantime and check the indicators of compromise in advisory FG-IR-26-175.
For the technical team
- CVE
- CVE-2026-104286
- Affected
- Fortinet FortiMail · FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6 and 8.0.0–8.0.1 (Fortinet); CSA lists 7.2.0 through 7.4.8, 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1 and refers to the vendor advisory for the full list.
- Exploitation
- Active exploitation reportedly underway, per CSA Singapore alert AL-2026-133 dated 6 October 2026. CSA references the CISA KEV catalog for CVE-2026-104286.
- Fix
- FortiMail 8.0.2 or later, 7.6.7 or later, 7.4.9 or later; 7.2.x installs must migrate to 7.4.9 or higher. Fortinet publishes workarounds in advisory FG-IR-26-175.
- Vector
- Path traversal (improper limitation of a pathname to a restricted directory) in FortiMail; an unauthenticated attacker can write arbitrary files on the underlying system via crafted HTTP or HTTPS requests (CSA).
- More details
- CVSS v3.1 9.8 (CSA). Fortinet advisory FG-IR-26-175; source metadata lists a start date of 2026-09-30. CSA recommends applying workarounds, updating, and scanning FortiMail deployments for IOCs available at the Fortinet PSIRT page.
Timeline
Incident opened.
Sources 2 sources
- Fortinet PSIRT FG-IR-26-175 Fortinet
- CSA Singapore alert CSA
