FortiMail path traversal allows unauthenticated attackers to write arbitrary files (CVE-2026-104286)

What happened

Fortinet's advisory describes an improper limitation of a pathname to a restricted directory (CWE-22) combined with improper neutralisation of NULL bytes (CWE-158). An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files on the underlying system. The CVSS 3.1 score is 9.8, with critical severity: the attack needs no privileges and no user interaction, and impact to confidentiality, integrity and availability is high.

CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities list on 1 October 2026, with a due date of 4 October 2026. Fortinet's PSIRT advisory says the flaw has been reported as exploited in the wild. ENISA EUVD also lists it as exploited since 1 October 2026.

Who is affected

Affected are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9, and 7.0.0 through 7.0.9. Fortinet lists fixed builds 7.4.9, 7.6.7 and 8.0.2. No fixed release is listed for FortiMail 7.0 or 7.2.

What to do now

1. Confirm which FortiMail version you run. The affected ranges are 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9 and 7.0.0 through 7.0.9.
2. Upgrade to a fixed build if one is available for your branch: Fortinet lists 7.4.9, 7.6.7 and 8.0.2. Apply the update as a priority; CISA added this to KEV on 1 October 2026, with a due date of 4 October 2026.
3. If you run 7.0 or 7.2, no fixed release is listed. Fortinet's advisory urges customers to apply its workaround, so read the vendor advisory for your branch. Until that is in place, restrict network access to the appliance and monitor for unexpected changes.
4. If an appliance was reachable over HTTP/S from the internet while running an affected version, consider that it may have been compromised and check for evidence of unauthorised file writes.

How to detect it

No specific indicators of compromise are included in Fortinet's advisory or the CVE record. Confirm your FortiMail version and exposure first. If the device has been reachable over HTTP/S while affected, check for signs of unauthorised file writes and treat changes on the appliance as cause for investigation.

Beyond the patch

This vulnerability is already being exploited, so patching is only the start: organisations with an exposed FortiMail should be ready to detect and respond to post-exploitation activity. Managed Detection & Response (MDR) and an Incident Response Retainer provide that capability. Because the flaw is reachable over the network without credentials, Virtual CISO Services can help you catalogue and reduce exposed mail gateways before the next advisory.