CVE-2026-104286 is a path traversal in Fortinet FortiMail, scored 9.8 out of 10. Path traversal means a request reaches files or functions the appliance never meant to expose. Fortinet says that lets an attacker execute unauthorized code or commands on a vulnerable device.

Fortinet's warning describes the flaw as a zero-day under active attack. A zero-day, by definition, is a flaw attackers are exploiting before the vendor has had a chance to ship a fix. CISA added it to its Known Exploited Vulnerabilities catalogue on 1 October.

The advisory and the exploitation arrived together. Nobody patched first.

FortiMail is a mail gateway. It sits in front of the mailboxes and reads the mail before the people do, which makes it a convenient place for someone else to read it too. Code execution on that box means access to whatever the gateway can see and whatever it is allowed to reach on the inside. The material available today does not say what the attackers did after they got in, and I will not guess at it.

A second edge appliance story is running alongside it. Unit 42 flagged possible zero-day activity against NetScaler, and Citrix reports CVE-2026-88771 and CVE-2026-88772 exploited in the wild. Two vendors, two perimeter products.

For an APAC bank running FortiMail, the check is short. List every FortiMail instance, including the ones a regional office stood up and forgot. Read Fortinet's advisory for whether a fixed build exists. Search the gateway logs for traversal patterns in requests. If an instance turns up exposed and unpatched, treat it as already compromised until the logs say otherwise.