Fortinet FortiMail path traversal exploited (CVE-2026-104286)

Fortinet FortiMail has a path traversal flaw, CVE-2026-104286, that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 1 October 2026. An unauthenticated attacker can write arbitrary files on the underlying system through crafted HTTP or HTTPS requests, and CISA set a remediation due date of 4 October 2026.

The flaw carries a CVSS score of 9.8 (critical). If you run an affected FortiMail version, treat this FortiMail vulnerability as an emergency and act today.

What happened

CISA listed the flaw as “Fortinet FortiMail Path Traversal Vulnerability” and added it to KEV, which means it has evidence of exploitation in the wild. The CISA entry also mentions an improper neutralisation of NULL byte or NULL character issue alongside the path traversal. NVD describes the core problem as a pathname that is not properly restricted to an intended directory, so a remote attacker can place files where they should not be able to.

Fortinet tracks the issue as FG-IR-26-175 in its PSIRT advisories. Details of the attacks seen, the attackers behind them and the number of victims have not been disclosed. CISA lists known ransomware campaign use as “Unknown”.

Am I affected? Is FortiMail affected?

NVD lists these FortiMail versions as affected:

• FortiMail 8.0.0 through 8.0.1
• FortiMail 7.6.0 through 7.6.6
• FortiMail 7.4.0 through 7.4.8
• FortiMail 7.2.0 through 7.2.9

The fixed versions are not stated in the data we reviewed, so check the Fortinet advisory FG-IR-26-175 for the exact releases and any workaround. Versions older than 7.2 are not mentioned either way, so confirm their status with Fortinet.

Technical details

• Weakness: CWE-22, improper limitation of a pathname to a restricted directory (path traversal).
• CVSS 3.1: 9.8 critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms: reachable over the network, low complexity, no privileges and no user interaction needed.
• Impact: arbitrary file write on the underlying system via crafted HTTP or HTTPS requests.
• KEV: added 2026-10-01, due 2026-10-04.
• EPSS: 0.022, about a 2.2% modelled chance of exploitation in the next 30 days. This is low next to the confirmed exploitation, and KEV status should carry more weight than this score.
• Published in NVD: 2026-10-01.

Why this matters

Analysis, not new facts. A mail gateway usually sits at the network edge, often reachable from the internet over HTTPS for the web interface or webmail. An unauthenticated file write on such a device is a strong foothold. Depending on which paths an attacker can reach, that could mean planted web shells, changed configuration or tampered scripts. The advisory data does not say which of these happen in the observed attacks.

The KEV listing and the very short deadline of three days after publication show how seriously CISA rates the risk. If a vulnerable FortiMail is exposed to the internet, assume it may already have been probed.

What to do: how to fix CVE-2026-104286

1. Inventory. List every FortiMail appliance and virtual machine, with its version, and mark which management and web interfaces face the internet.
2. Apply the vendor fix or mitigation. Follow Fortinet’s instructions in FG-IR-26-175. CISA’s required action is to apply the vendor mitigations, follow BOD 26-04 guidance, and discontinue use of the product if mitigations are not available.
3. Reduce exposure now. Until you are patched, restrict access to the web and administration interfaces to trusted networks or a VPN where your mail flow allows it.
4. Hunt for compromise. CISA’s required action refers to its forensics triage requirements. Patching does not remove a file an attacker has already written, so review the appliance before declaring it clean.
5. Tell the right people. Inform your mail and security owners, and record the patch date for compliance reporting if you fall under BOD 26-04.

Detection and hunting ideas

No indicators of compromise have been published in the sources available to us, so there are no IP addresses or file hashes to block. These ideas follow from the nature of the flaw:

• Search web server and reverse proxy logs for requests to FortiMail interfaces containing ../, encoded variants such as %2e%2e%2f, or NULL bytes (%00).
• Look for unexpected HTTP or HTTPS requests from unfamiliar external addresses to the appliance, especially from before 1 October 2026.
• Compare files on the appliance against a known-good baseline and look for recently created or modified files outside normal update windows.
• Watch for new outbound connections from the mail gateway to destinations it does not normally contact.

Bottom line

This is a KEV-listed, unauthenticated, network-reachable flaw in an internet-facing mail security product. Patch or mitigate within hours, not days, and check the appliance for signs of prior compromise.

Sources

• Fortinet PSIRT advisory FG-IR-26-175
• CISA KEV catalog entry for CVE-2026-104286
• NVD: CVE-2026-104286