FortiMail Path Traversal Vulnerability CVE-2026-104286

Catalog analysis: CISA added this entry on October 01, 2026. The entry reflects catalog information retrieved on October 02, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-104286 is a vulnerability in Fortinet FortiMail involving path traversal (CWE-22) and improper neutralization of NULL bytes or NULL characters (CWE-158). This flaw allows an unauthenticated attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests.

Exposure and applicability

This vulnerability affects organizations deploying Fortinet FortiMail. The attack vector is network-based, specifically targeting the web management or service interfaces (HTTP/HTTPS). Assets with direct internet exposure are at higher risk, as no authentication is required to trigger the file write. Because this vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog as of October 1, 2026, it should be treated as a high-priority exposure.

Remediation priorities

Our analysis suggests prioritizing remediation based on asset visibility and network placement:

1. Immediate Identification: Infrastructure owners should identify all FortiMail instances, specifically those accessible via the public internet.
2. Vendor Mitigation: Apply the mitigations provided by Fortinet in accordance with their PSIRT guidance (FG-IR-26-175).
3. Forensic Triage: Because CISA has flagged this for forensic triage, defenders should examine systems for evidence of unauthorized file creation or modification prior to applying patches.
4. Federal Compliance: U.S. federal agencies must adhere to the CISA due date of October 4, 2026, and follow BOD 26-04 guidelines.

How to validate remediation

Verification must go beyond confirming a version number or patch installation. To ensure exposure is reduced, defenders should:

• Verify Mitigation Application: Confirm that the specific vendor-recommended changes are active on the system.
• Test Access Controls: Validate that HTTP/HTTPS access to the FortiMail management interface is restricted to authorized administrative networks, reducing the reachable attack surface.
• Integrity Checks: Perform a baseline comparison of critical system files to ensure no arbitrary files were written before the mitigation was applied.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. While vendor mitigations are available, the effectiveness of these controls depends on correct implementation across all affected instances. There is residual risk if forensic triage is skipped, as a system could be patched while an attacker maintains persistence through files previously written to the disk.

Source and editorial note

CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability · Source date: October 01, 2026 · Retrieved October 02, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment