Fortinet Warns Critical FortiMail Flaw Is Being Exploited as a Zero-Day

Fortinet has warned that CVE-2026-104286, a path traversal flaw in its FortiMail mail gateway, is being exploited as a zero-day to run unauthorized code, according to BleepingComputer. The flaw is rated 9.8 out of 10, and CISA added it to its exploited-vulnerabilities catalogue on 1 October. Path traversal means an attacker tricks software into reading or writing files outside the folder it was meant to stay in. Here, no login is needed, and the result is attacker code running on the box that handles a company's email.

Rachel Lam of the Finance and Risk desk has the Hong Kong end of it. HKCERT published a Fortinet bulletin on 2 October warning of remote code execution and data manipulation flaws across Fortinet products, and it names a different identifier, CVE-2025-25249, as the one being exploited. The sources do not say whether that bulletin covers the FortiMail flaw, so a firm reading both holds two identifiers and one product family. Lam also walks through the HKMA, SFC and Insurance Authority frameworks. A mail gateway sits inside all three, and none of them names FortiMail.

Kai Tanner's Cyber Intel desk has the companion piece. Dark Reading reports three newly found Linux backdoors built to pose as mail security products from Asian vendors. Neither report links them to the Fortinet flaw, and the desk is careful not to. What they have in common is the location. A mail gateway sits at the boundary, sees every inbound message, runs with high privilege, and has a process list that nobody reads. Tanner's filing sets out the baseline check that catches a backdoor wearing the product's name.

So here is what it comes down to. The score is public, the catalogue date is public, and an attacker already holds the flaw. What is not public is the interval between CISA's 1 October listing and the day each company's own gateway was fixed. That interval is the exposure, and it belongs to each firm alone.