Fortinet sounds the alarm over actively exploited FortiMail zero-day

{
  "signal_id": "5f657745-cb9e-c31c-f7a2-89fa456ba8da",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-10-02T10:53:49+00:00",
  "company": {
    "name": "Fortinet",
    "domain": "fortinet.com"
  },
  "data": {
    "url": "https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803",
    "title": "Fortinet sounds the alarm over actively exploited FortiMail zero-day",
    "excerpt": "security No login required, exploitation underway, and some admins are still waiting for patches Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform. Fortinet describes the vulnerability as a combination of path traversal and improper handling of null characters in FortiMail's web interface. An unauthenticated attacker can exploit it using specially crafted HTTP or HTTPS requests to write arbitrary files to the underlying system. Writing files to certain locations could allow an attacker to execute code or commands on the appliance. Fortinet says the flaw affects FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. The vendor's advisory says CVE-2026-104286 \"is being exploited in the wild,\" although it doesn't say when the attacks began, who is behind them, or how many customers may have been compromised. It has, however, published indicators administrators can hunt for on their systems. These include suspicious files and configuration changes, along with IP addresses associated with the attacks. CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog...",
    "product": "FortiMail",
    "summary": "Fortinet's FortiMail email security platform has a critical zero-day vulnerability (CVE-2026-104286) that is being actively exploited, allowing unauthenticated attackers to write arbitrary files to vulnerable systems.",
    "planning": false,
    "image_url": "https://image.theregister.com/5300807.jpg?imageId=5300807&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683",
    "confidence": 1,
    "product_data": {
      "name": "FortiMail",
      "full_text": "Fortinet's email security platform",
      "fuzzy_match": false
    },
    "product_tags": [
      "online_technology",
      "general_technology",
      "security"
    ],
    "published_at": "2026-10-02T10:53:49Z",
    "vulnerability": "A critical zero-day vulnerability (CVE-2026-104286) in FortiMail's web interface, involving path traversal and improper handling of null characters, is being actively exploited in the wild, allowing unauthenticated attackers to write arbitrary files to the system via specially crafted HTTP or HTTPS requests.",
    "article_sentence": "Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in."
  }
}

curl https://signals.autobound.ai/v1/signals/5f657745-cb9e-c31c-f7a2-89fa456ba8da \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"fortinet.com","limit":20}'