Tag archive

Cve 2026 104286

Coverage tagged cve 2026 104286.

Data graphic: FortiMail exploited, no patch yet. A CVSS 9.8 score beside a KEV listed, no patch yet stamp; the workaround is to disable IBE and the CISA KEV due date is 4 October.

Cve 2026 104286 Exploits

Exploited FortiMail Flaw Has No Patch Yet: Disable IBE Now

Fortinet says attackers are exploiting CVE-2026-104286, a CVSS 9.8 FortiMail file-write flaw in the IBE portal. Fixed builds are not out yet: disable IBE now.

Related desks

Exploits

Latest

Oct 2, 2026, 8:06 AM EDT · Exploits · Cve 2026 54305 minWSO2 API Manager JWT Bypass Exploited 133 Days After the Fix

Forged admin tokens for WSO2 API Manager flaw CVE-2026-5430 (CVSS 10.0) hit honeypots 133 days after the fix. CISA's KEV entry describes the wrong bug.

Oct 2, 2026, 8:06 AM EDT · AI Security · Cve 2026 615005 minMythos Cracked Rejetto HFS Sessions From 12 Leaked Math.random() Values

Horizon3 used Anthropic's Mythos to find CVE-2026-61500: Rejetto HFS 3.x leaks Math.random() values that let attackers forge admin cookies. Fixed in 3.2.1.

Oct 2, 2026, 8:06 AM EDT · Exploits · Cve 2026 941274 minF5 BIG-IP APM: An Oversized Bearer Token Is Enough for Unauthenticated RCE

An unauthenticated attacker can run code on F5 BIG-IP APM with one oversized Bearer token — but only when APM is configured as an OAuth Authorization Server.

Oct 2, 2026, 8:06 AM EDT · Exploits · Cve 2026 869505 minApple Patches CoreGraphics Zero-Day Used Against Targeted iPhone Users

CVE-2026-86950, a CoreGraphics out-of-bounds write hit via a crafted file, was exploited on iOS before 27. Update to iOS 26.7.1, macOS 26.7.1 or 15.8.1.