A Vulnerability in Fortinet FortiMail Could Allow for Arbitrary Code Execution

A vulnerability has been discovered in Fortinet FortiMail that could allow for arbitrary code execution. Fortinet FortiMail is a secure email gateway that protects organizations from inbound threats including spam, phishing, malware, and business email compromise, while also preventing outbound data loss across physical, virtual, and cloud deployments. Successful exploitation of this vulnerability could allow an unauthenticated attacker to write arbitrary files to the underlying system, which could potentially lead to arbitrary code execution.

Fortinet reports that CVE-2026-104286 has been exploited in the wild.

A vulnerability has been discovered in Fortinet FortiMail that could allow for arbitrary file write on the underlying system, potentially leading to arbitrary code execution. Details of the vulnerability are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Successful exploitation of this vulnerability could allow an unauthenticated attacker to write arbitrary files to the underlying system, which could potentially lead to arbitrary code execution.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®