Latest / The Digital Warfare Podcast
EP. 172: FortiMail Zero-Day CVE-2026-104286 Exploited Before Patches Are Available
Summary
A critical Fortinet FortiMail vulnerability tracked as CVE-2026-104286 is being actively exploited in zero-day attacks.
The flaw carries a CVSS score of 9.8 and combines path traversal with improper NULL-byte handling. An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files to the underlying system, potentially enabling unauthorized command or code execution.
Fortinet has published workarounds and indicators of compromise while fixed releases for several affected branches remain upcoming. Organizations running exposed FortiMail appliances should…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.