Fortinet CVE-2026-104286 Zero-Day Added to CISA KEV Under Active Exploitation
CISA has added a critical Fortinet vulnerability, CVE-2026-104286, to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation in the wild and mandating immediate action from federal agencies.
Key findings
- Fortinet's CVE-2026-104286 is now on CISA's KEV catalog due to active exploitation.
- This critical vulnerability poses an immediate threat to affected Fortinet products.
- Organizations must prioritize and apply available patches without delay.
- CISA mandates federal agencies to remediate this flaw by the specified due date.
A newly identified critical vulnerability affecting Fortinet products, tracked as CVE-2026-104286, has been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. This inclusion on October 1, 2026, signals that the flaw is under active exploitation by threat actors, posing an immediate and significant risk to organizations utilizing vulnerable Fortinet solutions.
CVE-2026-104286 represents a severe security defect that attackers are actively leveraging to compromise systems. While specific details regarding the nature of the exploit are not publicly disclosed at the time of its KEV listing, its presence on the catalog indicates that it has been weaponized and is being used in real-world attacks. Such vulnerabilities often serve as initial access vectors for broader network intrusions, data theft, or other malicious activities.
CISA's KEV catalog is a definitive list of security vulnerabilities that have been confirmed to be actively exploited in the wild. Its purpose is to provide federal civilian executive branch (FCEB) agencies with a clear directive to prioritize and remediate these critical flaws. For CVE-2026-104286, this means federal agencies are required to address the vulnerability by the specified due date, typically within a very short timeframe, to protect their networks from ongoing threats.
All organizations, regardless of their federal affiliation, are strongly advised to heed this warning. The active exploitation of CVE-2026-104286 necessitates immediate attention within vulnerability management programs. Defenders should prioritize identifying any Fortinet products affected by this flaw within their environments and apply all available patches or mitigation measures without delay. Proactive remediation is crucial to prevent potential compromise and secure critical infrastructure against sophisticated attacks.