Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-104286: FortiMail lets remote attacker place files on server
CVE-2026-104286 · published 17 days ago · actively exploited
Summary
FortiMail's web interface can be tricked into accessing any location on the underlying system, allowing an unauthenticated user to drop files through specially crafted web requests. This could let attackers install malicious code or take control of the mail server. Install the latest FortiMail updates from Fortinet and limit web access to trusted users while monitoring for unusual file activity.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortimail |
8.0.0 >= 7.2.0, <= 7.4.8 >= 7.6.0, <= 7.6.6 >= 8.0.0, <= 8.0.1 |
Original advisory text
Fortinet FortiMail Path Traversal Vulnerability
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-175 Mitigation Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
2%
chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Track software like this
Free during beta