Fortinet FortiMail Vulnerability Exploited in the Wild: What Organizations Need to Know

Fortinet FortiMail users are facing a serious security issue after the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) published an Extremely High Risk security bulletin covering a vulnerability that can allow remote attackers to write arbitrary files to an affected system.

The vulnerability, tracked as CVE-2026-104286, affects multiple FortiMail versions. HKCERT also notes that the vulnerability is being exploited in the wild, increasing the urgency for organizations operating affected systems.

What happened?

HKCERT published its Fortinet security bulletin on October 2, 2026. The bulletin identifies vulnerabilities in Fortinet products that could allow a remote attacker to trigger remote code execution and data manipulation.

For the vulnerability highlighted in the alert, HKCERT specifically identifies CVE-2026-104286 and states that it is being exploited in the wild.

The vulnerability involves two related weaknesses:

• Path traversal, where attacker-controlled input can escape an intended directory

• Improper handling of NULL bytes or NULL characters

According to HKCERT, an unauthenticated attacker could use specially crafted HTTP or HTTPS requests to write arbitrary files on the underlying system.

That file-writing capability is particularly important because arbitrary file modification can provide a path toward further compromise, including code or command execution. HKCERT lists remote code execution and data manipulation as impacts.

Which FortiMail versions are affected?

HKCERT lists the following FortiMail releases as affected:

These version ranges come directly from the HKCERT bulletin. Organizations should compare their installed FortiMail version against the affected ranges rather than assuming that every Fortinet product is vulnerable.

The alert is specifically focused on FortiMail. HKCERT does not list FortiGate, FortiManager or other Fortinet products as affected by this particular CVE in the bulletin.

Why the exploitation status matters

The most significant part of the alert is not simply that a vulnerability exists. HKCERT states that CVE-2026-104286 is being exploited in the wild.

This means organizations using an affected FortiMail release should treat the issue as an active security concern rather than waiting for evidence that an attack has reached their own environment.

The bulletin also links to a CISA alert concerning the addition of the vulnerability to the Known Exploited Vulnerabilities catalog.

For security teams, an actively exploited vulnerability in an internet-facing security appliance can require faster remediation because the affected system may sit at an important boundary between an organization and external traffic.

What is the potential impact?

HKCERT identifies two primary impacts for the vulnerability:

1. Remote code execution

2. Data manipulation

The underlying issue allows an unauthenticated attacker to send specially crafted HTTP or HTTPS requests that can result in arbitrary file writing.

From a security operations perspective, this matters because successful exploitation of a security appliance can have consequences beyond the vulnerable application itself.

However, the HKCERT bulletin does not provide specific information about individual organizations that have been compromised, the number of successful attacks, or the exact attack campaigns responsible.

Additional details were not disclosed in the announcement.

What should FortiMail administrators do?

HKCERT recommends applying the fixes issued by Fortinet and directs administrators to the Fortinet PSIRT advisory FG-IR-26-175 for vendor-specific information.

Organizations should begin by identifying whether they operate one of the affected FortiMail versions.

1. Check the installed FortiMail version

Review every FortiMail deployment and compare its version with the affected ranges listed by HKCERT.

This is especially important for organizations with multiple appliances or separate production, backup and testing environments.

2. Review Fortinet's security advisory

HKCERT directs administrators to Fortinet's official PSIRT advisory for CVE-2026-104286.

The vendor advisory should be treated as the authoritative source for the applicable remediation and any updated instructions.

3. Apply the vendor-provided fix

HKCERT explicitly recommends applying the fixes issued by Fortinet. Administrators should follow the instructions in the Fortinet advisory rather than relying on unofficial patches or assumptions about which releases resolve the issue.

4. Review internet exposure

Security teams should determine whether affected FortiMail management or other relevant interfaces are accessible from untrusted networks.

Reducing unnecessary external exposure can be an important part of incident response and vulnerability mitigation, but administrators should follow the vendor's current workaround guidance for the exact configuration.

5. Investigate for possible compromise

Because HKCERT states that the vulnerability is being exploited in the wild, organizations operating affected systems should consider reviewing relevant logs and security telemetry for suspicious activity.

A clean initial review should not automatically be interpreted as proof that an appliance has never been compromised.

The company did not provide specific information about this area in the HKCERT announcement.

What makes this vulnerability different from a routine patch?

Security teams regularly deal with software vulnerabilities. The difference here is the combination of several factors documented by HKCERT.

First, the affected product is FortiMail, a security appliance used for email-related infrastructure. Second, the vulnerability can be exploited remotely without authentication, according to the bulletin's description. Third, the weakness can permit arbitrary file writing. Finally, HKCERT explicitly states that the vulnerability is being exploited in the wild.

Together, these factors make version verification and remediation particularly important for organizations operating affected systems.

This does not mean every affected FortiMail deployment has been compromised. It means organizations should assess their exposure and follow the vendor's remediation guidance.

Broader cybersecurity context

The incident highlights a broader industry shift toward treating vulnerabilities in internet-facing security infrastructure as high-priority operational risks.

Security appliances often occupy privileged positions within enterprise networks. As a result, vulnerabilities in these systems can attract attention from attackers because successful exploitation may provide access to infrastructure that handles or controls security-sensitive traffic.

The FortiMail case also demonstrates why vulnerability management needs to consider more than CVE severity alone.

Security teams typically need to combine:

• The affected product and version

• Whether the system is externally reachable

• Whether authentication is required

• Whether exploitation has been observed

• Available vendor fixes or mitigations

• Relevant logs and monitoring data

• The role of the affected system within the organization

For enterprises, this can mean coordinating vulnerability remediation with network, email, security operations and incident-response teams.

What organizations should monitor now

Organizations running FortiMail should keep monitoring Fortinet's PSIRT guidance and relevant security advisories for changes to affected versions, fixes or mitigation instructions.

They should also maintain an accurate inventory of Fortinet appliances and their software versions.

For security operations teams, useful review areas can include:

• Unexpected HTTP or HTTPS requests

• Unusual file modifications

• Unexpected administrative activity

• Changes to appliance configuration

• Suspicious outbound connections

• Authentication or access anomalies

• Relevant FortiMail system and security logs

These checks are general defensive practices. Specific indicators of compromise or forensic procedures were not provided in the HKCERT bulletin.

Key takeaway

HKCERT has classified the Fortinet FortiMail issue as Extremely High Risk and identified CVE-2026-104286 as being exploited in the wild. The vulnerability can allow an unauthenticated remote attacker to write arbitrary files through crafted HTTP or HTTPS requests, with remote code execution and data manipulation listed among the potential impacts.

Organizations using FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 or 7.2.0-7.2.9 should verify their exposure and follow the remediation instructions provided by Fortinet.

For the latest technical details and remediation guidance, administrators should consult the official Fortinet PSIRT advisory referenced by HKCERT.