CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

In an advisory published on October 1, 2026[2], Fortinet said the flaw "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests"[2], according to Help Net Security. The outlet Shattered reports that the flaw carries a CVSS score of 9.8[3].watchTowr says that once an attacker places a file on the system, they gain a way to run commands on the device itself[4]. The firm adds that this can lead to full control of the mail gateway, exposing stored mail, credentials, and other systems it connects to[4].According to watchTowr, FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9 are affected[4]. Shattered reports that Fortinet has announced that fixes are planned for versions 8.0.2, 7.6.7, and 7.4.9[3].watchTowr advises administrators to disable the Identity-Based Encryption feature or block internet access to the management interface[4]. Help Net Security reports that Fortinet has also shared the files, IP addresses and log entries tied to the attacks[2].According to Help Net Security, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog the same day, and gave US federal civilian agencies until October 4, 2026, to address it[2]. BleepingComputer reports that CISA also requires federal agencies to perform forensic triage[1].Fortinet told BleepingComputer that it is "communicating with relevant government organizations, including CISA, on the content of this advisory."[1]