Path Traversal Vulnerability in Fortinet FortiMail Products
CVE-2026-104286
Key Information:
Badges
What is CVE-2026-104286?
CVE-2026-104286 is a critical path traversal vulnerability affecting Fortinet FortiMail products, specifically in versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. FortiMail is designed to enhance email security for organizations by providing protection against threats such as spam, malware, and phishing attacks. This particular vulnerability allows unauthenticated attackers to craft malicious HTTP or HTTPS requests, which can lead to the unexpected writing of arbitrary files on the underlying system. The improper handling of pathname restrictions presents a severe risk, as it could enable attackers to manipulate system files, potentially leading to further security breaches and compromising the integrity of the entire email system.
Potential impact of CVE-2026-104286
-
Unauthorized File Manipulation: The vulnerability allows attackers to write arbitrary files on the server, which can lead to unauthorized changes in system configurations or the placement of malicious files, potentially facilitating further attacks.
-
Data Breach Risks: By exploiting this vulnerability, attackers can gain access to sensitive data stored on the affected systems, leading to potential data leaks or breaches, which can have serious legal and reputational repercussions for organizations.
-
System Compromise: If exploited, this vulnerability can allow an attacker to gain control over the affected FortiMail instance, enabling them to execute additional malicious actions, such as installing malware or launching further attacks within the organization's network.
CISA has reported CVE-2026-104286
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-104286 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected Version(s)
FortiMail 8.0.0
FortiMail 7.6.0 <= 7.6.5
FortiMail 7.4.0 <= 7.4.6
News Articles
CybersecuritynewsCVE-2026-104286CISA Adds Fortinet FortiMail 0-day Vulnerability to KEV Following Active Exploitation
CISA added critical Fortinet FortiMail flaw CVE-2026-104286 to its KEV catalog following evidence of active exploitation.
3 weeks ago
International Business TimesCVE-2026-104286FortiMail Zero-Day CVE-2026-104286 Is Under Attack With No Patch Yet
Fortinet's critical FortiMail zero-day CVE-2026-104286 is being exploited, but fixed builds are still pending. Here's what administrators should do now.
3 weeks ago
TechtimesCVE-2026-104286Hackers Backdoor Fortinet FortiMail Email Gateways With No Password; Patches Unavailable
Fortinet FortiMail zero-day CVE-2026-104286 lets unauthenticated attackers write arbitrary files to email gateways and plant persistent backdoors. CISA added the CVSS 9.8 path traversal flaw to its
3 weeks ago
References
CVSS V3.1
Timeline
- 📈
Vulnerability started trending
- 📰
First article discovered by Securityweek
- 👾
Exploit known to exist
- 🦅
CISA Reported
Vulnerability published
Vulnerability Reserved