by Kastro
Paper/Archive/CVE-2026-104286

CVE-2026-104286

Fortinet FortiMail — Fortinet FortiMail Path Traversal Vulnerability

KEV · due 4 OctEPSS 5%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
98
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 91.6.916 × 2018.3Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Affected

ProductAffectedFixed inSource
FortiMail8.0.0 – 8.0.1–CNA
FortiMail7.6.0 – 7.6.6–CNA
FortiMail7.4.0 – 7.4.8–CNA
FortiMail7.2.0 – 7.2.9–CNA
FortiMail7.0.0 – 7.0.9–CNA

Scores by source

fortinet (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-26-175refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286kevcisa.gov/known-exploited-vulnerabilities-catalog