Our automated tracking framework flagged that CISA added CVE-2026-104286 (Fortinet FortiMail) to the Known Exploited Vulnerabilities (KEV) catalog on October 3, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-104286 by October 4, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-104286 |
| Vendor / product | Fortinet FortiMail |
| Vulnerability | Fortinet FortiMail Path Traversal Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | October 1, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | October 4, 2026 |
| Known ransomware use | No |
How This Compares to Fortinet’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published.
| Fortinet in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 31 |
| Median lag (public → KEV listing) | 7 days |
| 0-day rate (exploited at or before disclosure) | 35% |
| Entries tied to known ransomware campaigns | 13 |
For perspective, the median across all 1733 tracked KEV entries is 245 days — Fortinet’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Fortinet KEV Additions
The most recent Fortinet vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2025-25249 | Multiple Products | September 9, 2026 | 239 | No |
| CVE-2025-68686 | FortiOS | July 27, 2026 | 167 | No |
| CVE-2026-25089 | FortiSandbox | July 16, 2026 | 37 | No |
| CVE-2026-39808 | FortiSandbox | July 16, 2026 | 93 | No |
| CVE-2026-21643 | FortiClient EMS | April 13, 2026 | 66 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has urgently added CVE-2026-104286, a Fortinet FortiMail vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog with a critical CVSS base score of 9.8. This listing on October 1, 2026, with a federal patch deadline of October 4, 2026, signals immediate and severe risk. Its 0-day lag between public disclosure and KEV listing means organizations had virtually no detection window.
Organizations using Fortinet FortiMail must prioritize patching immediately. Given its confirmed exploitation and 0-day listing, unpatched systems are likely under active attack. There’s no known ransomware use with this CVE yet, but the vulnerability could lead to significant data compromise or system control, making it a prime target for various threat actors.
If immediate patching isn’t feasible before the deadline, implement compensating controls. These may include network segmentation, strict egress filtering, enhanced monitoring for unusual activity originating from FortiMail instances, and reviewing access controls to sensitive directories. Proactive threat hunting for any signs of compromise is also important.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
