CISA adds Fortinet FortiMail path traversal CVE-2026-104286 to the Known Exploited Vulnerabilities Catalog

A federal catalog entry on evidence of active exploitation puts FortiMail on the priority queue that Binding Operational Directive 26-04 imposes on civilian agencies and that CISA asks every other organization to follow.

IN BRIEF: On October 1, 2026, the Cybersecurity and Infrastructure Security Agency added CVE-2026-104286, a Fortinet FortiMail path traversal vulnerability, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation.

The Cybersecurity and Infrastructure Security Agency added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on October 1, 2026, and named it in a single line: CVE-2026-104286, a Fortinet FortiMail path traversal vulnerability. CISA says the addition rests on evidence of active exploitation. For any operator of FortiMail, and for any buyer who treats the catalog as a patch-priority list, that is the fact that changes the week.

The alert does not expand the technical record. It gives no CVSS score, no affected build, no patch identifier, and no date by which remediation is due. It does not describe the exploitation evidence, name an incident, or quote Fortinet. What it does fix is the class of flaw and the risk judgment attached to that class. Immediately after the CVE line, CISA states: “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” Path traversal is the type named. The sentence attaches to the type. It is not a published proof of total compromise on a named network.

The operational instrument is Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk. CISA states that BOD 26-04 establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. In the alert’s account, the directive reinforces the KEV Catalog and requires those agencies to prioritize rapid remediation of high-risk vulnerabilities — specifically Common Vulnerabilities and Exposures (CVEs) listed in the catalog on publicly exposed assets that grant total control of the asset post-exploitation — while deferring action on lower-risk vulnerabilities. BOD 26-04, the alert continues, “further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.”

Two limits belong in the same reading. The total-control and public-exposure language is the directive’s sorting rule, not a finding this page makes about CVE-2026-104286 itself. The alert does not say the FortiMail flaw grants total control, and it does not say the affected systems face the internet. The binding duty also stops at FCEB agencies. CISA is explicit: “While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.” That encouragement is the channel through which a federal catalog entry becomes a question for private mail-gateway owners, managed-service providers, and enterprise buyers who have written the KEV Catalog into their own patch policy.

Catalog membership is an evidentiary claim with a stated threshold. CISA says it will continue to add vulnerabilities that meet specified criteria. For outside nominations, the alert sets three conditions: a CVE ID, evidence of exploitation, and clear mitigation guidance. Intake is the KEV Nomination Form. Applied back to this entry, those conditions are what CISA is asserting it has already satisfied for CVE-2026-104286 — an identifier, evidence of exploitation, and mitigation guidance clear enough to list — without reproducing the evidence or the guidance on this page. Silence on the guidance is a limit of the alert, not a statement that no mitigation exists.

Fortinet appears only as the vendor of FortiMail. No executive is named. No customer count, no deployment share, and no company statement appear in the release. What does appear is a federal judgment that this path-traversal class is a frequent attack vector and a significant risk to the federal enterprise, paired with a directive that tells FCEB agencies to move high-risk catalog items first and to check for compromise that predates the patch. Security reviewers, insurer questionnaires, and procurement teams that mirror that standard will ask three things the alert itself does not answer: which FortiMail versions are in scope, whether the instance is publicly exposed, and whether a compromise check has been run. Those questions follow from the text. They are not findings in it.

Investor and founder scrutiny should track the same split. The confirmed act is the October 1, 2026, addition of CVE-2026-104286 to the Known Exploited Vulnerabilities Catalog. Active exploitation is the basis CISA states; the evidence is not published in this alert. Remediation under BOD 26-04 is described as rapid for the high-risk set, but this release does not assign CVE-2026-104286 a due date. Until a version range and a mitigation note are read from a document that actually contains them, the defensible record stops at the catalog act, the path-traversal classification, the federal-enterprise risk sentence, and the FCEB-versus-everyone-else scope of BOD 26-04.

WHY IT MATTERS: A KEV listing is CISA’s public statement that a flaw is already being used, and BOD 26-04 tells civilian federal agencies to remediate the high-risk catalog set first and to check for compromise before the patch. The same alert asks every other organization to adopt that priority, so FortiMail owners outside government inherit the question even though the directive does not bind them.