Critical FortiMail ZeroDay Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The US Cybersecurity and Infrastructure Security Agency CISA on Thursday added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog following reports of active exploitation The vulnerability tracked as CVE2026104286 CVSS score 98 allows unauthenticated attackers to write arbitrary files on the underlying system An improper