sign in--:--:--UTC

CVE-2026-104286

exploited in the wild☆ pin

CVSS

9.8

Reports

7

First seen

Oct 1, 2026

Last seen

Oct 13, 2026

Affected product

Fortinet FortiMail

Associated actors

KillSec ×1 RatHat operators ×1 ShinyHunters ×1 Star Blizzard ×1 Storm-3069 ×1

Recent reports

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, including 3 zero-days

Bleeping ComputerOct 13, 2026 High

Weekly Recap: NetScaler and FortiMail Zero-Days, KillSec Arrests, Spectre v2 Variant

The Hacker NewsOct 5, 2026 Critical

Fortinet FortiMail Remote Code Execution Vulnerability (CVE-2026-104286)

GovCERT.HKOct 5, 2026 High

Fortinet FortiMail vulnerabilities (CVE-2026-104286) exploited in the wild

Canadian Centre AlertsOct 2, 2026 Critical

Critical FortiMail Zero-Day Exploited in Attacks Enables Unauthenticated File Writes

The Hacker NewsOct 2, 2026 Critical

Fortinet warns of critical FortiMail zero-day flaw actively exploited in attacks

Bleeping ComputerOct 2, 2026 High

CISA Adds Fortinet FortiMail Path Traversal to Known Exploited Vulnerabilities Catalog

CISA AdvisoriesOct 1, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans