FortiMail Zero-Day Vulnerability (CVE-2026-104286) Actively Exploited, Added to CISA KEV Catalog

A critical path-traversal flaw in Fortinet's FortiMail email security gateway, tracked as CVE-2026-104286 with a CVSS v3.1 base score of 9.8, is being actively exploited. The Cybersecurity and Infrastructure Security Agency (CISA) has added this zero-day vulnerability to its Known Exploited Vulnerabilities (KEV) catalog due to its active exploitation.