CVE-2026-104286 carries a 9.8 out of 10 severity score, and CISA added it to its exploited-vulnerabilities catalogue on 1 October. Fortinet's own warning, as BleepingComputer reports it, says the FortiMail path traversal flaw was being used as a zero-day to run unauthorized code. So the patch has a score, a catalogue date and an attacker already holding it (the one number missing is how many days a given firm's gateway sat open before it was fixed).

HKCERT published its own Fortinet bulletin on 2 October. It warns of remote code execution and data manipulation flaws across Fortinet products, and it names CVE-2025-25249 as the one being exploited. The sources I have do not say whether that bulletin covers the FortiMail flaw. A firm reading both has two identifiers and one product family.

Kai Tanner's cyber desk filing sits next to this. Dark Reading reports three newly found Linux backdoors built to look like mail security products from Asian vendors. Neither report links them to the Fortinet flaw. The point they share is where the box sits: at the boundary, handling every inbound message, with high privilege and a process list nobody reads.

Here is what that means for the regulated desks. For a bank, the institution-wide technology risk module is HKMA's SPM TM-G-1, and a mail gateway is squarely inside it. For a licensed corporation, SFC's circular 26EC32 on AI-enabled cyberattacks folds those threats into the existing cybersecurity and incident response frameworks. For an authorized insurer, the Insurance Authority's GL20 sets the minimum cybersecurity standard. None of the three names FortiMail. The question each leaves with the firm is whether it can say which of its edge boxes run which firmware, and on which date it patched.

My read: the exposure is a date, and the date that counts is the gap between CISA's 1 October listing and the day each firm's gateway was fixed.