CVE-2026-104286 chains a path traversal with a NULL-byte neutralization bug, and together they let anyone who can reach a FortiMail web interface write arbitrary files to the box without logging in — the kind of primitive that turns into a web shell fast. CISA added it to the Known Exploited Vulnerabilities catalog on October 1, citing evidence of real-world attacks, and Fortinet's own advisory (FG-IR-26-175) went out the same day marking it unauthenticated and critical. Affected builds span FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. The awkward part: as of October 3 there is no patch. Fortinet says fixes are coming in 8.0.2, 7.6.7, and 7.4.9 but hasn't dated them, so mitigation means pulling the admin interface off the internet and running CISA's forensic-triage check for signs you were already hit. CISA set the federal remediation deadline at October 4 under Binding Operational Directive 26-04 — a three-day fuse instead of the usual three weeks, which tells you how seriously it's taking this one.