Fortinet's email security appliance is under active attack through an unauthenticated path traversal that can write arbitrary files to the underlying system. The bug is CVE-2026-104286. CISA added it to the Known Exploited Vulnerabilities catalog on 1 October with a 4 October federal due date.

Photo: Dev Jadiya / Wikimedia Commons (CC BY-SA 4.0), cropped