CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

According to Help Net Security, Fortinet's October 1 advisory said the flaw "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests"[2]. The Hacker News reports a CVSS score of 9.8.[3]Security firm watchTowr says that by placing a file on the system, "the attacker gains a way to run commands on the device itself,"[4] which it says could lead to full control of the mail gateway.Help Net Security reports that the flaw affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9[2]. The outlet says Fortinet will fix it in versions 8.0.2, 7.6.7 and 7.4.9, which have not been released, and advises 7.2 users to upgrade to the 7.4 branch or above[2].According to BleepingComputer, Fortinet says that until patches arrive, admins can disable IBE feature support[1] or keep the management interface off the internet.Help Net Security reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, and gave US federal civilian agencies until October 4, 2026, to address it[2]. Security Affairs gives a different deadline and reports that CISA orders federal agencies to fix the flaw by October 3rd, 2026.[5]BleepingComputer says Fortinet has not disclosed when the flaw was first exploited, how many systems were compromised, or who is behind the attacks.[1]