CVE-2026-104286: Fortinet FortiMail: Path Traversal | Rafael Pfister

Analysis on rafaelpfister.ch

Article · October 2, 2026 CVE-2026-104286: FortiMail Zero-Day Is Being Exploited - Workaround and Compromise Assessment Fortinet reports a critical, actively exploited path traversal vulnerability in FortiMail 7.2 through 8.0 (CVE-2026-104286, CVSS 9.8). A patch is not yet available. The workaround disables IBE or blocks Internet access to the management interface; indicators for assessing compromise are also available.

Vendor description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Reference data

Vendor

Fortinet

Affected products

FortiMail

CVSS 3.1

9.8 (CRITICAL)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Weakness type

CWE-22: Path Traversal

Published

October 1, 2026

In KEV catalog since

October 1, 2026

US federal deadline

October 4, 2026

Official sources

← All vulnerabilities