CISA adds actively exploited FortiMail path traversal flaw to KEV catalog
In short: CISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize patching this vulnerability on internet-exposed assets, especially where it could grant full control of the system. CISA also recommends all organizations, not just federal agencies, prioritize remediation of KEV-listed flaws.
This summary was generated automatically by AI from CISA Advisories's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1CVE-2026-104286: Fortinet FortiMail path traversal vulnerability added to the KEV Catalog
- 2Confirmed evidence of active exploitation
- 3BOD 26-04 requires FCEB agencies to prioritize remediation on publicly exposed assets
- 4Agencies may need to check for prior compromise before patching
Why it matters
Email gateway appliances like FortiMail are frequently exposed to the internet and attractive targets for attackers seeking initial access, so confirmed exploitation raises urgency for any organization running the product.
What it means for AI agents and contact centers
If any mail relay or gateway infrastructure in your stack runs Fortinet FortiMail, check the affected versions, apply the vendor patch, and review logs for signs of prior exploitation before patching; this is not related to core voice/AI components but matters if FortiMail sits in the network perimeter.
Sources
- CISA AdvisoriesOfficialPrimary sourceOriginal article →„CISA Adds One Known Exploited Vulnerability to Catalog“1 Oct 2026, 15:00Licence: US federal government work (17 U.S.C. §105) · our summary (content changed)
- Published by source
- 1 Oct 2026, 15:00
- Found by our system
- 2 Oct 2026, 22:23
- Summary generated
- 3 Oct 2026, 20:03
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy