CISA Flags a FortiMail Path-Traversal Flaw as Actively Exploited

CISA has added CVE-2026-104286, identified in its alert as a Fortinet FortiMail path-traversal vulnerability, to the Known Exploited Vulnerabilities Catalog. The agency says the addition is based on evidence of active exploitation.

The listing is a priority signal, not proof that a specific network was breached. CISA's notice labels the flaw as path traversal, but it does not give affected FortiMail versions, describe the attack path or report a victim count.

What covered federal agencies must do

Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies. It requires rapid remediation for high-risk cataloged vulnerabilities on publicly exposed assets when exploitation would give an attacker total control. It also sets expectations for deciding when an agency must check whether a system was compromised before it was patched.

How other organizations can use the listing

The directive is limited to covered federal agencies. CISA nevertheless encourages every organization to use risk-based vulnerability management and prioritize flaws in the catalog. For private organizations, that is agency guidance rather than a federal mandate.

CISA also accepts nominations for exploited vulnerabilities that are not yet listed. A candidate must have a CVE identifier, evidence of exploitation and clear mitigation guidance to qualify for consideration.