FortiMail: Traficom warns of active exploitation

What is confirmed

Traficom identifies CVE-2026-104286, a CVSS 3.1 score of 9.8 and observed active exploitation. The flaw may allow unauthenticated file writes and compromise the email system. [1]

Affected branches

According to Traficom, affected releases are 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9. The authority lists fixes in 8.0.2, 7.6.7 and 7.4.9 or later in the respective branch. For 7.2, upgrading to a newer branch is advised. Confirm the current target version with Fortinet before installation. [1]

Our practical checks

Have a recovery path ready before changing a critical email component.

1. Confirm that the product is FortiMail and record its exact version.
2. Prepare a configuration backup, recovery procedure and maintenance window.
3. Update according to the vendor's instructions and test both incoming and outgoing email.
4. Review anomalies and investigate any compromise separately.

Limits of the evidence

This warning does not establish that a particular company in the region has been affected. The vendor's complete upgrade instructions have not been verified for this article. Follow the link in Traficom's advisory before making a change.

Plan a controlled fix

This is a practical checklist. It does not replace the vendor instructions identified as unverified in this article's evidence limitations.

1. Open the vendor link in Traficom's advisory and confirm the target release, intermediate upgrades and known issues for your model.
2. Save the configuration and decide how to recover from a failed change. Inform the responsible person about possible email disruption.
3. Install during the maintenance window using the confirmed instructions.
4. Send controlled incoming and outgoing test messages, review queues and check the reported software version.

Need a common workflow?

The guide “A vulnerability has been found – take it through to a verified fix” explains how to check whether you are affected, prepare recovery and verify the result.