Fortinet FortiMail Path Traversal and NULL Byte Flaw
Fortinet FortiMail path traversal flaw (CVSS 9.8) lets unauthenticated attackers write arbitrary files. Actively exploited; CISA KEV listed October 1, 2026.
- Vendor
- Fortinet
- Product
- FortiMail
- CVSS
- 9.8
- EPSS (exploit probability)
- 2.2%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
CVE-2026-104286 is a path traversal combined with improper NULL byte neutralization in Fortinet FortiMail. An unauthenticated attacker can craft HTTP or HTTPS requests that bypass directory access controls and write arbitrary files to the underlying system. CVSS score is 9.8 (Critical), per NVD.
Affected products
Fortinet FortiMail. Consult the NVD record and Fortinet’s security advisory for the full affected version matrix and the patched releases.
Exploitation status
CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities catalog on October 1, 2026, confirming active exploitation in the wild. Fortinet warned customers before a public patch was available, making this a zero-day at time of disclosure. Federal agencies must remediate by October 4, 2026, per CISA BOD 26-04.
Mitigation
Apply the Fortinet patch for FortiMail per vendor guidance. If immediate patching is not possible, restrict FortiMail management interfaces to trusted internal networks and block external access to the affected endpoints as an interim control. Review access logs for unexpected file creation or unusual activity since at least September 2026.
