On October 1 Fortinet disclosed CVE-2026-104286, a path-traversal flaw in FortiMail that lets an unauthenticated attacker write arbitrary files to the system. It scores 9.8 out of 10, it was already being exploited as a zero-day when the advisory went out, and CISA added it to the Known Exploited Vulnerabilities catalog the same day with an October 4 deadline for US federal agencies. The detail that makes it instructive: as of October 2 there was no fixed build available for any affected branch. Affected versions span 7.2.0 to 7.2.9, 7.4.0 to 7.4.8, 7.6.0 to 7.6.6, and 8.0.0 to 8.0.1.
Does this affect you
Probably not directly. FortiMail is a secure email gateway appliance, more common in mid-sized organizations, schools, municipalities and at IT providers than in a ten-person company running Microsoft 365 or Google Workspace. If your email security is whatever came with your tenant, this specific flaw is not your emergency.
It is worth five minutes anyway, for two reasons. If you outsource IT, your provider may well run Fortinet gear, and this is a fair thing to ask about. And the situation itself, a critical flaw under active attack with no patch to install, happens often enough that having a response for it is more useful than having a response for this particular CVE.
What you do when there is no patch
The instinct is to wait for the fix. That is the one option the attackers are counting on. The actual playbook:
- Reduce who can reach it. Almost every critical appliance flaw requires network access to the vulnerable service. Restricting that service to known addresses, or taking the management interface off the public internet, converts an emergency into a scheduled job. This was the real lesson of the MikroTik flaw last week too.
- Apply the vendor workaround, and read it carefully. Vendors usually publish mitigations before fixes. They often disable something you use, which is a tradeoff to make consciously rather than discover.
- Assume you need to look, not just wait. Zero-day means exploitation predates disclosure. Check logs for the indicators in the advisory, and treat unexplained files or accounts on the device as a finding rather than a quirk.
- Decide who is watching for the fix, by name and with a date to check. Vulnerabilities with no patch get forgotten precisely because there is no action to close the ticket.
- Know what the device can reach. An email gateway sits in the path of all your mail and often holds credentials to your mail platform. Compromise there is not contained to the appliance.
The pattern worth noticing
Fortinet found this one internally, which is to its credit, and has not said when exploitation began, how many appliances were hit, or who is behind it. That gap is normal and it is also the problem: you are asked to make a risk decision with incomplete information, quickly. Security appliances keep showing up in this position because they are internet-facing by design, they are trusted deeply, and they are patched on nobody's schedule in particular. The organizations that handle it calmly are the ones that already know what they run, where it is exposed, and who owns updating it.
What to actually do this week
- If you run FortiMail, apply Fortinet's advisory guidance now, restrict access to the affected service, review logs for compromise, and set a reminder to check for the fixed build.
- If someone else runs your IT, send one email: do we have any Fortinet devices, are they affected by CVE-2026-104286, and what have you done. The quality of the answer tells you something beyond this CVE.
- Either way, list the internet-facing devices and services you own and confirm each has a named owner for updates. That list is what makes the next one of these a short conversation.
The takeaway
Most small businesses can read this one as someone else's fire drill. The transferable part is the habit: when a critical flaw lands with no fix available, your options are to shrink the exposure, apply the workaround deliberately, check whether you were already hit, and name who is watching for the patch. None of that requires the vendor to ship anything first.