Cyber Security· Important
CISA adds actively exploited FortiMail path traversal flaw to KEV catalog
CISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize patching this vulnerability on internet-exposed assets, especially where it could grant full control of the system. CISA also recommends all organizations, not just federal agencies, prioritize remediation of KEV-listed flaws.