Within the first four days of October 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including a FortiMail flaw rated 9.8. Alongside the Cisco Secure Email Gateway issues of the same month, the pattern is hard to ignore: mail gateways are being exploited as primary targets, not as incidental parts of a broader campaign.

The immediate facts

CVE-2026-104286 affects Fortinet FortiMail with a CVSS score of 9.8 and was added to the KEV catalog in the first week of October 2026, based on confirmed exploitation. Fortinet published fixed releases and mitigation guidance in its advisory channel.

The same reporting round included Zammad issues CVE-2026-102489 and CVE-2026-102490 at 9.4, and a Citrix NetScaler flaw CVE-2026-88779 at 8.7. Treating these as separate stories obscures what makes the month notable: the KEV additions were concentrated on systems that sit in front of user communication and authentication.

Why mail gateways keep appearing

A mail gateway is the only system in the enterprise that is required to accept arbitrary content from unauthenticated senders anywhere on the internet. Firewalls inspect packets; mail gateways parse documents, archives, scripts and markup — often with multiple scanning engines layered on top.

Three consequences follow.

The attack surface is the product's purpose. Any parser handling attacker-supplied attachments is a candidate for a memory-safety or path-handling flaw. Reducing that surface means reducing functionality.

The privilege level is high and the visibility is low. These appliances run as root by design, because they must write to quarantine, integrate with directories and manage their own services. Meanwhile, security teams look at the mail gateway's effectiveness at filtering, not at whether its own binary is behaving correctly.

The blast radius is credentials. A mail gateway that integrates with a directory for recipient validation holds bind credentials. One that terminates TLS holds keys. One that provides webmail holds sessions.

The Cisco case in October 2026 demonstrated the shape precisely: a path traversal in the file reputation pipeline, reachable with a crafted attachment, leading to root command execution without user interaction.

What a FortiMail compromise would mean

Without publicly documented exploitation detail for CVE-2026-104286, the reasonable planning assumptions come from the product's role rather than from speculation about the exploit:

  • Mail flow can be silently altered. Rules and routing are configuration; a compromised gateway can change them.

  • Message content and metadata can be read. Quarantine and archive storage contain mail that was never delivered.

  • Credentials configured for directory integration or administrative access may be exposed.

  • Trust in the gateway as a security control is invalidated until rebuild.

Any of those is sufficient to justify treating patch status as urgent rather than scheduled.

Operational guidance that holds across vendors

Verify component versions, not just platform versions. The Cisco case turned on a scanner package rather than the firmware. Fortinet deployments similarly carry signature and engine versions alongside the firmware version. Check both.

Keep management access off the internet. Mail gateways need SMTP from anywhere. They do not need administrative UI access from anywhere. This single change removes a class of exposure.

Monitor outbound behaviour. A mail gateway that initiates connections to unfamiliar hosts is the strongest available indicator of an implant, precisely because the appliance is otherwise expected to make predictable outbound connections for reputation and update services.

Preserve before rebuild. Quarantine storage and configuration are incident evidence. An appliance rebuilt without preservation cannot answer what was read.

Rotate the credentials the appliance held. Directory bind accounts, relay credentials and API keys used for integration.

The uncomfortable conclusion

Organizations continue to expose mail gateways with administrative interfaces reachable from the internet, on the reasoning that the product is professionally managed and vendor-supported. Both of those facts were true of every appliance compromised in October 2026.

The relevant question is not whether a vendor's product is well engineered. It is whether your deployment gives an attacker a reachable path to a system whose failure invalidates your trust in email itself.

References