Swiss SME Cyber Alert: FortiMail – actively exploited flaw threatens email security gateways

FortiMail protects business email traffic. CISA says a critical vulnerability is already being actively exploited and can be abused over HTTP or HTTPS without signing in. If your business or IT provider uses FortiMail, the system should now be checked, secured, and examined for possible compromise.

What happened?

On 1 October 2026, Fortinet published security advisory FG-IR-26-175 for CVE-2026-104286. A path validation flaw allows an attacker to send a crafted HTTP or HTTPS request and write arbitrary files to the underlying system without authentication.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on the same day, confirming that real-world exploitation is occurring.

Could my business be affected?

Businesses may be affected if they use Fortinet FortiMail as an email security gateway, physical appliance, or virtual machine. The service may be operated by an IT provider or data centre, so the FortiMail name may not be familiar internally.

Using Microsoft 365 alone does not mean that you are affected. However, FortiMail can sit in front of Microsoft 365 or another mail server.

What should you do now?

Ask your IT provider today to identify any FortiMail systems and compare their versions and configuration with Fortinet’s current advisory.

Your provider should install the vendor’s fixed release or apply the official interim mitigation, restrict management access until remediation is complete, and check the appliance for signs of earlier compromise using Fortinet’s guidance.

How urgent is it?

Very urgent. The vulnerability is critical, can be attacked remotely without authentication, and is being actively exploited. Waiting for the next routine maintenance window is not appropriate.

Information for your IT provider

CVE: CVE-2026-104286 · Product: Fortinet FortiMail · Rating: CVSS 9.8 (critical).

Attack path: crafted HTTP or HTTPS request; no authentication or user interaction is required.

Potential impact: arbitrary file write on the system, which can enable unauthorised commands or code to run.

Required action: check the current affected-version table and remediation guidance in FG-IR-26-175, apply the fix or official interim mitigation, and perform a compromise assessment because exploitation is confirmed.

Official sources

Fortinet PSIRT FG-IR-26-175: https://www.fortiguard.com/psirt/FG-IR-26-175

CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286