cisa.govadvisoryCISA KEV: Fortinet FortiMail CVE-2026-104286 path traversal, actively exploited, no patch yet
CISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation. The alert restates the obligations of BOD 26-04 for Federal Civilian Executive Branch agencies: prioritise KEV CVEs on publicly exposed assets that give total control, and check for compromise before patching. It also describes the KEV nomination criteria: a CVE ID, evidence of exploitation and clear mitigation guidance. The page gives no technical detail, patch status or IOCs.
TL;DR CISA adds actively exploited FortiMail path traversal CVE-2026-104286 to the KEV Catalog, with BOD 26-04 remediation context.
Organisations named here
- BOD 26-04
- CISA
CVEs named here
- CVE-2026-104286
Technologies named here
- Fortinet FortiMail
- CISA Known Exploited Vulnerabilities Catalog
- CISA KEV Nomination Form
- Binding Operational Directive 26-04
- CISA KEV
Techniques named here
- Path traversal
- Risk-based vulnerability management
- Compromise checks
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup