Fortinet FortiMail: CVE-2026-104286 #
Fortinet disclosed that certain versions of FortiMail contain an improper limitation of a pathname to a restricted directory ('path traversal') and improper neutralization of NULL byte vulnerabilities. These flaws allow an unauthenticated, remote attacker to write arbitrary files to the underlying system via crafted HTTP or HTTPS requests. This vulnerability has been designated CVE-2026-104286 and has been rated critical with a CVSS score of 9.8.
Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026.
The following versions are affected
- FortiMail 8.0: Versions 8.0.0 through 8.0.1
- FortiMail 7.6: Versions 7.6.0 through 7.6.6
- FortiMail 7.4: Versions 7.4.0 through 7.4.8
- FortiMail 7.2: Versions 7.2.0 through 7.2.9
What is Fortinet FortiMail? #
FortiMail is Fortinet's email security appliance, providing antispam, antivirus, and data loss prevention capabilities for inbound and outbound mail traffic.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an unauthenticated, remote attacker to write arbitrary files to the underlying system, potentially leading to unauthorized system compromise or loss of availability.
Are any updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- FortiMail 8.0: Upgrade to version 8.0.2 or later.
- FortiMail 7.6: Upgrade to version 7.6.7 or later.
- FortiMail 7.4: Upgrade to version 7.4.9 or later.
- FortiMail 7.2: Upgrade to the 7.4 branch or later.
Workaround:
- Disable Identity-Based Encryption (IBE) support using the CLI. Consult the vendor advisory for further details.
- Alternatively, disable access to the FortiMail management interface from the internet or restrict access to a trusted private network.
Finding exposed Fortinet FortiMail appliances with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
hw:="Fortinet FortiMail"
