Attackers were working with a Fortinet mail gateway flaw before Fortinet said the flaw existed. The company published advisory FG-IR-26-175 on October 1, 2026, covering CVE-2026-104286, and confirmed that exploitation was already underway when the advisory went live.
The bug sits in the web management interface of FortiMail, Fortinet's secure email gateway appliance. A path traversal weakness, combined with improper handling of NULL bytes, lets an attacker send a crafted HTTP or HTTPS request that writes a file outside the directory it should reach. No login is required. Fortinet scores it 9.8 out of 10 on CVSS v3.1, and the impact line in the PSIRT record reads "Execute unauthorized code or commands."
That combination is why this one lands differently from a routine advisory. Fortinet had not shipped fixes across all four affected branches when it published. The vendor listed target releases (8.0.2, 7.6.7, 7.4.9) as upcoming, and administrators running FortiMail 7.2 were told to move to branch 7.4 or above instead. Between October 1 and an actual patch, the only things standing between an exposed gateway and an intruder were a workaround and the shape of a company's network.
What the workaround actually buys
Fortinet's guidance has two parts. Disable Identity-Based Encryption (IBE), or keep the management interface off the internet and reachable only from trusted networks. Fortinet has not published a root-cause writeup, but the fact that the workaround targets IBE tells administrators where the vulnerable code path runs.
watchTowr, which keeps a running FAQ on the CVE, put it plainly: deployments exposing the FortiMail management interface to the internet, with IBE enabled, are the ones to fix first. That is Fortinet treating that configuration as the most likely attack route.
The workaround closes the door. It doesn't tell you who already walked through it.
CISA's three-day clock
The Cybersecurity and Infrastructure Security Agency added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on October 1, the same day the advisory came out. Federal Civilian Executive Branch agencies got until October 4 to remediate.
Three days is a short window for a federal agency, and a shorter one for a mid-market company running FortiMail on a change-control cycle that measures in weeks. The KEV entry also flags the vulnerability for forensic triage under BOD 26-04, which is the government's way of saying patch it, then go look for what happened while it was open.
eSentire's advisory made the same point in blunter operational language. Patching does not remove persistence mechanisms an attacker already established. The firm's Threat Response Unit went hunting across customer environments for Fortinet's published indicators of compromise. Fortinet's list of IoCs is short, covering suspicious files, unusual log entries, and attacker IP addresses, and administrators have to match it against their own appliances by hand.
The bug was found inside the company. Fortinet's Product Security team identified it internally and credited Gwendal Guegniaud with the discovery, which means Fortinet was working from an internal report rather than an outside researcher's disclosure. No threat actor attribution has been made public. watchTowr says so directly in its FAQ, and the absence of a name is its own problem for defenders trying to judge urgency.
October's other open doors
FortiMail did not arrive alone. It is the fourth edge-appliance flaw in roughly two weeks to land in the KEV catalog, and the pattern is hard to miss.
CISA issued an alert on September 27 for critical zero-days in Citrix NetScaler ADC and NetScaler Gateway. Four CVEs were involved: CVE-2026-88771 and CVE-2026-88772 at 9.5, CVE-2026-88773 at 9.3, and CVE-2026-88774 at 7.0. A further flaw, CVE-2026-88779, hit the catalog on October 4 with a CVSS of 8.7. eSentire's follow-up tracking of NetScaler exploitation ran under the headline "More Shells Than a Seafood Buffet," which tells you how much traffic its analysts were seeing.
On October 6, the Cyber Security Agency of Singapore issued an alert on CVE-2026-76504, a flaw in Cisco Catalyst SD-WAN Manager that also scores 9.8. Improper URI encoding in the API's session-based authentication management lets an unauthenticated remote attacker send one crafted HTTP request and gain API access with admin privileges. Cisco had already shipped fixes across five version branches by then, which is the one thing Cisco got right here.
watchTowr published an advisory the same week on CVE-2026-21589, an arbitrary file read affecting eight self-hosted Atlassian Data Center and Server products, including Confluence and Jira.
Four vendors. One month. Every one of these products sits at the boundary between an internal network and the internet, and every one of them is reachable without credentials.
Why gateways get hit
There's a reason attackers keep landing in this class of device, and it isn't sophistication. Mail gateways, VPN concentrators, and SD-WAN controllers hold something no internal server has: a permanent, unfiltered position in the mail and network path, plus credentials for everything downstream. Take the gateway and you inherit its trust.
It's also a hard patch target. A FortiMail instance sits in the mail path for the whole company. Reboot windows are negotiated, not declared, and an admin's instinct to protect mail flow is reasonable right up until the moment it isn't. Fortinet's advice to disable IBE and pull the management interface back behind trusted networks takes minutes and requires no firmware change. That gap between a five-minute mitigation and a three-week change window is the whole story.
I don't think October 4 is the date anything ends. It's the date federal paperwork closes. For everyone else the clock started October 1, when someone sent the first unauthenticated request that worked.
The thing to watch is whether Fortinet's fixed builds actually ship on the schedule it implied. 8.0.2, 7.6.7, and 7.4.9 were all listed as upcoming on October 1, and vendor advisory pages drift when a company has to produce four separate releases at once. Administrators who disabled IBE and closed the management interface have bought themselves time. They haven't bought a patch.
Check the CISA Known Exploited Vulnerabilities catalog and Fortinet's PSIRT advisory FG-IR-26-175 before assuming your build is covered. More coverage of actively exploited flaws sits in our cybersecurity desk, and earlier advisories are in the archive.