A critical zero-day flaw in Fortinet’s FortiMail email security gateway is being actively exploited, and no patch is available yet. The bug, tracked as CVE-2026-104286, carries a CVSS score of 9.8.

The flaw combines a path traversal weakness with a null-byte issue. It lets an attacker with no login credentials write arbitrary files to the system through crafted web requests to the management interface. Researchers say observed attacks use it to drop a persistent backdoor on the device.

Fortinet published advisory FG-IR-26-175 on October 1. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day and gave US federal agencies until October 4 to apply workarounds. Fixed builds are still in development.

Until patches ship, Fortinet urges customers to disable the IBE encryption feature and to block internet access to the management interface. Affected versions span FortiMail 7.2.0 through 8.0.1. The flaw was found internally by Fortinet’s own product security researcher Gwendal Guegniaud.