CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

Fortinet's advisory, as quoted by Help Net Security, says the flaw "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests"[2]. The Hacker News reports that it carries a CVSS score of 9.8[3].According to watchTowr, an attacker who places a file on the system gains a way to run commands on the device itself[4]. The firm says this "can lead to full control of the mail gateway, exposing stored mail, credentials, and other systems it connects to."[4]Help Net Security reports that CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog the same day, and gave US federal civilian agencies until October 4, 2026[2] to fix it. BleepingComputer says CISA also requires federal agencies to perform forensic triage[1].WatchTowr lists the affected versions as FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9[4]. WindowsForum reports that "the published data doesn't fully agree with itself"[5] on which versions are affected.Suped reports that the 8.0.2, 7.6.7 and 7.4.9 releases are marked upcoming[6]. According to watchTowr, Fortinet's workaround is to disable the Identity-Based Encryption feature or block internet access to the management interface[4].Help Net Security says Fortinet has also shared the files, IP addresses and log entries tied to the attacks[2] so administrators can check whether their appliances were compromised.