On 1 October 2026, Fortinet disclosed a critical path traversal vulnerability in FortiMail, its secure email gateway, and confirmed it was already being exploited in the wild. Tracked as CVE-2026-104286, the flaw lets an unauthenticated attacker write arbitrary files to the appliance by sending specially crafted HTTP or HTTPS requests. CISA added it to its Known Exploited Vulnerabilities catalog the same day, as reported by Cybersecurity Dive.
The impact goes well beyond a single file write. Researchers at watchTowr explained that once an attacker can place a file on the underlying system, they can run commands on the device and take full control of the mail gateway. From there, stored email, credentials and connected systems are all within reach. watchTowr also described the flaw as very easy to exploit, which means the window between disclosure and widespread abuse is likely to be short.
At the time of disclosure, Fortinet had not given a date for a security patch. Instead, it advised customers to disable identity-based encryption support, or to take the FortiMail management interface off the internet and restrict it to trusted private networks. The company did not say when exploitation began.
This is the latest in a run of Fortinet security problems over the past year. In June 2026, CISA urged organisations to harden their Fortinet environments after thousands of firewall and VPN credentials were compromised, and critical FortiSandbox vulnerabilities were exploited during the same month. The recurring pattern is internet-facing appliances with exposed interfaces becoming the entry point for attackers.
The lesson is about attack surface. Fortinet’s own workaround is to hide the management interface from the internet. That is exactly the principle behind zero trust network access: administrative and private resources should never be publicly reachable in the first place.
What is CVE-2026-104286?
It is a critical path traversal vulnerability in Fortinet FortiMail. It allows an attacker with no credentials to write files anywhere on the appliance using crafted web requests, which can then be used to run commands and take over the device.
Is the FortiMail flaw being actively exploited?
Yes. Fortinet confirmed exploitation in the wild when it disclosed the flaw, and CISA added it to the Known Exploited Vulnerabilities catalog on 1 October 2026. US federal agencies are required to act on KEV entries, and every other organisation should treat the listing as a strong signal to prioritise it.
What can an attacker do after exploiting it?
An attacker who gains control of FortiMail effectively owns the organisation’s email gateway. That includes access to stored mail, any credentials held on the appliance, and a foothold for moving into other connected systems. Because email gateways sit at the centre of business communication, the potential for data theft and follow-on attacks is significant.
Is there a patch available?
When the advisory was published, Fortinet had not announced a patch date. Check Fortinet’s PSIRT advisory FG-IR-26-175 for the latest status, as this may have changed since disclosure.
What should FortiMail customers do right now?
Fortinet recommends disabling identity-based encryption support. If that isn’t possible, the management interface should be blocked from internet access and limited to trusted private networks. Teams should also review logs for unexpected file writes or unusual administrative activity, rotate credentials stored on or used by the appliance, and apply the official patch as soon as it is released.
Why do Fortinet appliances keep showing up in exploitation reports?
Fortinet products are widely deployed and many sit directly on the internet, which makes them attractive targets. This FortiMail zero-day follows the mass credential compromise affecting Fortinet firewalls and VPNs and the FortiSandbox exploitation, both in June 2026. The common thread is publicly reachable interfaces that attackers can probe and attack without logging in.
Does Cloudbrink replace FortiMail?
No. FortiMail is an email security gateway, and Cloudbrink is not an email filtering product. Cloudbrink is a high-performance zero trust network access (ZTNA) service that replaces legacy VPNs and controls how users reach private applications and infrastructure.
So how is Cloudbrink relevant to this vulnerability?
The most effective mitigation Fortinet offers is to take the management interface off the public internet. Cloudbrink makes that the default state for private resources. Its connectors use outbound-only connections, so admin consoles and internal applications don’t need open inbound ports and aren’t visible to internet scanners. Administrators still get fast, secure access through the Cloudbrink app, while attackers have nothing to target.
How does Cloudbrink verify who gets access?
Cloudbrink grants app-level access based on user identity and device posture, rather than broad network-level access. Connections use mutual TLS 1.3, and security certificates are rotated roughly every eight hours as part of Cloudbrink’s Automated Moving Target Defense. Even if credentials are stolen from a compromised system, access to protected resources still depends on a trusted device and a valid, frequently changing certificate.
Should organisations using Fortinet VPNs be concerned too?
This specific flaw affects FortiMail, not Fortinet’s VPN products. However, the June 2026 credential compromise did involve Fortinet firewalls and VPNs. Organisations reassessing their exposure to internet-facing appliances may want to review remote access at the same time, and moving from a traditional VPN to ZTNA removes another publicly reachable target from the perimeter.
What is the broader takeaway for security teams?
Every appliance with an internet-facing interface is a potential entry point, and zero-days will continue to appear faster than patches can be applied. Reducing what is publicly reachable is one of the most reliable defences available. Patching remains essential, but keeping management interfaces and private apps dark means the next critical flaw has far less to work with.