vulnerability · Thu 01 Oct 2026 · 22:53 UTC
Actively exploitedCISA adds CVE-2026-104286 (Fortinet FortiMail) to the Known Exploited Vulnerabilities catalog
Filed UTCSource CISA ↗also carried by 1 outlet
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). …
Signals
as the pipeline stamped them- KEV
- Active exploitation (KEV)
- What to do
- On CISA KEV — actively exploited. Patch immediately.
CISA KEV means this flaw has been seen exploited in real attacks — not predicted, observed. Treat it as urgent regardless of its score.
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-104286 | KEV | 2% | NVD ↗ |
Sources · 2
outlets reporting the same storyGet the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.