What’s Vulnerable › Vulnerabilities

CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-10-01
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-28
• Weakness: CWE-22

Description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Affected products

• Fortinet FortiMail: from 7.0.0 through 7.0.9; from 7.2.0 through 7.2.9; from 7.4.0 before 7.4.9; from 7.6.0 before 7.6.7; from 8.0.0 before 8.0.2 — fixed in 7.4.9, 7.6.7, 8.0.2
• Fortinet FortiMail: from 8.0.0 through 8.0.1; from 7.6.0 through 7.6.6; from 7.4.0 through 7.4.8; from 7.2.0 through 7.2.9; from 7.0.0 through 7.0.9

How to fix

Upgrade to a fixed version: Fortinet FortiMail 7.4.9, 7.6.7, 8.0.2. Check the vendor advisory for mitigations.

In the news

• Improper limitation of a pathname to a restricted directory

References

• https://fortiguard.fortinet.com/psirt/FG-IR-26-175
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286

Get alerted when CVE-2026-104286 or the next vulnerability affects your stack