CISA adds Fortinet FortiMail zero-day CVE-2026-104286 to KEV catalog

Situation Overview

On 2 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a critical Fortinet FortiMail vulnerability, CVE-2026-104286, to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. The flaw, rated CVSS 9.8, allows unauthenticated attackers to write arbitrary files on the underlying system. The KEV listing signals that defenders should prioritize remediation for FortiMail systems exposed to the internet. Fortinet is the vendor of the affected product, while CISA is the US agency issuing the KEV directive and maintaining the catalog used to drive federal and sector response. No other scheduled actions or deadlines were reported in the cluster beyond the KEV addition and the need to patch affected systems.

Geopolitical Implications

1. 01

   US government KEV action highlights ongoing cross-sector pressure to remediate actively exploited vulnerabilities in critical enterprise communication security tooling.

2. 02

   Actively exploited zero-days in email security can accelerate broader cyber incident risk for organizations operating across US critical infrastructure and government-adjacent networks.

Key Signals

• —

  Whether CISA issues additional guidance or updates to the KEV entry for CVE-2026-104286.

• —

  Vendor patch releases and deployment guidance for FortiMail systems exposed to the internet.

• —

  Reports of exploitation indicators and attacker TTPs tied to CVE-2026-104286.

Topics & Keywords

Market Impact Analysis

AI Threat Assessment

Event Timeline