CISA Elevates Fortinet FortiMail Path Traversal to Critical KEV Status
CISA has added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. This vulnerability allows attackers to bypass security controls and potentially gain unauthorized access to sensitive files and directories on affected FortiMail systems. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities that grant total control of assets post-exploitation. This incident highlights the ongoing targeting of enterprise email security solutions by threat actors, reflecting a broader trend of exploiting communication infrastructure vulnerabilities. Organizations rely heavily on email security gateways, making them attractive targets for initial access and data exfiltration campaigns.
Kill Chain
