Fortinet Warns of Actively Exploited Zero-Day in FortiMail Email Appliance

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. The flaw affects FortiMail email security appliances and was disclosed on October 1, 2026. Fortinet confirmed that the vulnerability is being actively exploited in the wild, though initial reports indicate that specific attack vector details are still emerging. The company has released security updates addressing the flaw and strongly urges all FortiMail users to apply the latest firmware versions immediately to protect their email infrastructure from potential compromise. The vulnerability poses a significant risk as successful exploitation could lead to full compromise of the email security appliance, potentially allowing attackers to intercept, modify, or block email traffic within an organization. Fortinet's advisory emphasizes the urgency of patching, noting that the zero-day exploitation status means systems remaining on older firmware versions are at immediate risk. The company has not disclosed detailed technical exploitation information publicly, citing ongoing investigation, but has confirmed that the flaw allows command execution outside of the intended security context. Security researchers recommend that organizations prioritize this update alongside other critical patches due to the active exploitation in the wild.