FortiMail zero-day CVE-2026-104286: CVSS 9.8 authentication bypass added to CISA KEV

CISA added CVE-2026-104286, a critical authentication bypass vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog on October 4, 2026. The flaw carries a CVSS v3.1 base score of 9.8 and allows unauthenticated remote attackers to execute arbitrary code on affected mail security appliances. Federal civilian executive branch agencies are required to apply mitigations by the CISA-specified deadline.

Vulnerability details

The vulnerability exists in the FortiMail web administration interface and does not require any form of prior authentication or user interaction. A remote attacker who can reach the management interface can send a specially crafted HTTP request that bypasses the authentication check entirely, then proceed to run commands with the privileges of the FortiMail service process. Fortinet's advisory classifies the vulnerability as an improper authentication flaw in the API authentication pathway. Affected versions span multiple FortiMail release branches, and Fortinet has confirmed active exploitation in the wild.

Why FortiMail is a high-value target

Mail security appliances occupy a privileged position in enterprise network architecture. They process every inbound and outbound email message, have access to decrypted message content, and often hold integration credentials for directory services and downstream mail systems. An attacker with persistent access to a FortiMail appliance can silently copy or redirect email traffic, extract credentials embedded in messages, modify email content in transit, or use the appliance as a pivot point deeper into the network. This makes FortiMail a logical target for espionage-oriented threat actors as well as credential-harvesting groups.

Mitigation and incident response steps

Apply the Fortinet-provided patches for CVE-2026-104286 immediately. If patching cannot happen within 24 hours, restrict all access to the FortiMail management interface to a dedicated management network segment or specific administrator source IPs, and block external access entirely. After patching, audit all administrator and API accounts for unauthorized additions, review FortiMail logs for unusual outbound connections or unexpected API calls, and treat any system where exploitation cannot be ruled out as a potential source of credential exposure. Rotate LDAP bind credentials and any other directory integration service accounts that FortiMail uses.

Broader context: Fortinet vulnerabilities in 2026

This is the fourth Fortinet product vulnerability to reach CISA's KEV catalog in 2026, continuing a trend of nation-state and criminal actors treating Fortinet's product line as a reliable initial access vector. Prior Fortinet KEV entries in 2026 covered FortiOS, FortiProxy, and FortiManager. Organizations with Fortinet-heavy environments should evaluate whether their patching cadence for network security appliances matches the elevated threat tempo this product family is experiencing.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization needs help assessing Fortinet vulnerability exposure or prioritizing patch remediation.