CISA Flags Fortinet FortiMail Vulnerability as Actively Exploited, Adds It to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially listed a critical flaw in Fortinet's FortiMail email security appliance in its Known Exploited Vulnerabilities (KEV) catalog, signaling that the vulnerability is already being leveraged by threat actors.

The defect, identified as CVE-2026-104286, carries a high CVSS rating, underscoring its potential impact on affected systems. While the agency’s advisory does not disclose technical details, the inclusion of the CVE in the KEV catalog indicates that malicious actors have demonstrated the ability to exploit the weakness in real‑world attacks.

CISA’s KEV catalog is a curated register of vulnerabilities for which there is credible evidence of active exploitation. The list is intended to help federal agencies—and by extension, private‑sector organizations—prioritize patching and mitigation efforts for the most urgent threats. In recent months, the catalog has grown to include flaws affecting widely deployed products ranging from network routers to cloud services, reflecting the agency’s broader push to improve the nation’s cyber resilience.

Fortinet, a leading provider of network security solutions, typically responds to such disclosures by issuing security advisories and patches. Although the company has not yet released a detailed bulletin for CVE-2026-104286, experts expect an update to be forthcoming, and administrators of FortiMail deployments are advised to monitor Fortinet’s security portal closely and apply any patches as soon as they become available.

The addition of the FortiMail vulnerability to the KEV list serves as a reminder that email infrastructure remains a high‑value target for attackers. Organizations that rely on FortiMail for inbound and outbound email filtering should conduct a rapid inventory of affected devices, verify that the latest firmware is installed, and consider additional monitoring for signs of compromise. As cyber threats continue to evolve, timely remediation of known, exploited flaws remains a cornerstone of both federal and private‑sector defense strategies.