AX·NEWS
Sign in

Vulnerability

CVE-2026-104286 — Fortinet FortiMail Path Traversal Vulnerability

critical 9.8 Exploited in the wild 3 stories · 3 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • Fortinet FortiMail 8.0.0 · ≤ 7.6.5 · ≤ 7.4.6 +2

Path traversal · over the network · no login

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8,

CISA Known Exploited Vulnerabilities

Added on 2026-10-01, federal remediation due 2026-10-04. Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
    USSecurityWeek Cybersecurity

    CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system. The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek .

  2. Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
    INThe Hacker News Cybersecurity

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The…

  3. Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
    USBleepingComputer Cybersecurity

    Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]