FortiMail path-traversal / NULL-byte flaw (CVE-2026-104286) remains on CISA KEV (added 1 Oct); Fortinet FG-IR-26-175 updated 5 Oct with fixed builds (8.0.2+ / 7.6.7+ / 7.4.9+; 7.2 → 7.4+) — unauth arbitrary file write via crafted HTTP(S); patch + forensic triage under BOD 26-04.
CISA added CVE-2026-104286 to KEV on 1 Oct 2026 (unauthenticated path-traversal / NULL-byte arbitrary file write on FortiMail). Fortinet FG-IR-26-175’s 5 Oct solution update lists fixed builds: 8.0.2+, 7.6.7+, 7.4.9+; 7.2 branch moves to 7.4+. Soft hold: ransomware campaign use Unknown; temporary mitigations (disable IBE / restrict webmail) are not a substitute for upgrade; no invented Nigerian campaigns. Not a re-Brief of Oct 5’s Citrix KEV thin line — Citrix remains today’s full-story slot.
Source: CISA — adds one Known Exploited Vulnerability to catalog (2026-10-01) · Vendor: Fortinet FG-IR-26-175 (updated 2026-10-05) · Soft hold: no invented NG campaigns; ransomware Unknown; do not invent IoCs beyond Fortinet/CISA published