CVE-2026-104286: fortinet fortimail

CVSS 9.8 (critical) · listed as exploited by CISA since 2026-10-01 · published 2026-10-01

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Affected products (NVD): fortinet fortimail

Fixed in (NVD): 7.4.9, 7.6.7, 8.0.2

Weakness: CWE-22

Source: NVD CVE-2026-104286

References

• https://fortiguard.fortinet.com/psirt/FG-IR-26-175
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.