FortiMail Zero-Day CVE-2026-104286 Actively Exploited

FortiMail zero-day CVE-2026-104286 is under active attack

The headline for this week is Fortinet FortiMail. CVE-2026-104286 is a path traversal vulnerability carrying a CVSS score of 9.8, and multiple sources confirm it is being exploited in the wild as a zero-day. CISA added it to the Known Exploited Vulnerabilities catalog on October 1, which moves it from patch eventually to patch now.

If you run FortiMail for inbound mail security, this is urgent. SecurityWeek and Help Net Security both flagged the exploitation, and Cyber Security News reported active attacks against the flaw. Treat any internet-facing FortiMail appliance as exposed and apply Fortinet's fix without waiting for a maintenance window.

Two Zammad flaws added to KEV the next day

On October 2, CISA added two more non-Microsoft vulnerabilities to the catalog, both in Zammad, the open-source help desk platform. CVE-2026-102489 is a session fixation flaw and CVE-2026-102490 is improper privilege management, each rated CVSS 9.8. Cyber Security News reported the pair was chained to gain remote code execution and root access.

Neither Zammad flaw is tagged ransomware-linked yet, but KEV listing means exploitation is confirmed. If you expose a Zammad instance, patch it and review session and admin activity for signs of fixation or privilege abuse.

Hot movers already on KEV and ransomware-linked

Beyond the fresh additions, several CVEs remain high-priority because they combine KEV listing, high EPSS, and ransomware activity. JetBrains TeamCity CVE-2026-63077 (CVSS 9.8, EPSS 0.90) and the older CVE-2024-27199 (EPSS 0.9999) are both ransomware-linked. WebPros cPanel and WHM CVE-2026-41940 sits at EPSS 0.9853, Palo Alto PAN-OS authentication bypass CVE-2026-0257 at 0.9638, Meta React Server Components CVE-2025-55182 at a perfect 10 CVSS, and Oracle E-Business Suite CVE-2025-61882 at EPSS 0.9973. ConnectWise ScreenConnect CVE-2024-1708 rounds out the ransomware-active set. If any of these touch your estate, they belong above routine patching.

What the press adds this week

Microsoft pushed a new Exchange Server V2 update after finding a new security flaw, per Cyber Security News, so Exchange administrators should expect a reissue and plan to redeploy. Separately, researchers detailed a session cookie vulnerability that lets attackers bypass Entra ID MFA and impersonate users. Token and session theft remain the path around multifactor authentication, so revoke sessions and tighten conditional access and token protection where you can.

On the ransomware front, the Warlock group has expanded SharePoint exploitation against critical infrastructure in Portuguese and Spanish-speaking countries, according to SecurityWeek and The Record. Crypto scammers also hijacked Microsoft's official X account, a reminder that account takeover hits even the largest brands.

Do this first

Priority order for the next 48 hours, grounded in this week's confirmed exploitation:

• Patch internet-facing FortiMail for CVE-2026-104286 now; it is KEV-listed and actively exploited.
• Patch Zammad for CVE-2026-102489 and CVE-2026-102490, then review session and admin logs.
• Confirm the Exchange Server V2 reissue is applied cleanly on your mail servers.
• Hunt for Entra ID session cookie theft and revoke suspect sessions; verify token protection and conditional access.
• Check your Microsoft patch state against this month's KEV-flagged rollups, including KB5046616 for Windows Server 2022 and KB5046617 for Windows 11 24H2.

Check your own exposure

Senserva's free non-Microsoft exploited-CVE tracker follows CISA KEV additions daily, so you can confirm whether FortiMail and Zammad fixes are landing across your systems. For the Windows rollups, the free Microsoft Patch Tracker ranks open patches by KEV, EPSS, and ransomware linkage so you can see which of this week's KBs matter most to you.

Sources

• Cyber Security News: Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks (2026-10-02)
• SecurityWeek: Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action (2026-10-02)
• Help Net Security: Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) (2026-10-02)
• Cyber Security News: Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access (2026-10-02)
• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-02)
• CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-10-01)
• Cyber Security News: Microsoft Pushes New Exchange V2 Update After Discovering New Security Flaw (2026-10-03)
• Cyber Security News: Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users (2026-10-02)
• SecurityWeek: Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks (2026-10-02)
• The Record: 'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries (2026-10-02)
• SecurityWeek: Crypto Scammers Hijack Microsoft’s Official X Account (2026-10-02)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-03.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.