FortiMail path traversal lets unauthenticated attackers write arbitrary files (CVE-2026-104286)

What happened

Fortinet describes CVE-2026-104286 as a path traversal weakness in FortiMail. An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files on the underlying system. The CVSS 3.1 vector is network-based and low-complexity, requiring no privileges or user interaction, with high impact on confidentiality, integrity and availability; the score is 9.8 critical.

This is being exploited in the wild. CISA added the flaw to the KEV catalogue, CISA SSVC rates exploitation as active, ENISA EUVD records exploitation since 2026-10-01, and Fortinet's PSIRT advisory says the issue has been reported to be exploited in the wild.

Who is affected

Affected FortiMail versions are 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9, and 7.0 all versions (listed as 7.0.0 through 7.0.9 in the CVE record). Fixed builds are FortiMail 7.4.9, 7.6.7 and 8.0.2. No fixed release is listed for FortiMail 7.0 or 7.2.

What to do now

1. Read Fortinet's FG-IR-26-175 advisory and apply the workaround it describes. Fortinet says customers are urged to apply the workaround.
2. Upgrade affected installations to the fixed releases: FortiMail 7.4.9, 7.6.7 or 8.0.2. If you run FortiMail 7.0 or 7.2, no fixed release is listed; follow Fortinet's guidance and CISA's required action, which says to discontinue use of the product if mitigations are unavailable.
3. Review the CISA KEV entry. CISA's due date is 2026-10-04, and the required action is to apply vendor mitigations, follow BOD 26-04 guidance, and evaluate internet exposure of affected systems.

How to detect it

Fortinet's advisory does not publish specific indicators of compromise. Because the flaw allows writing arbitrary files through crafted HTTP or HTTPS requests, review FortiMail access logs for unexpected or malformed requests and check the underlying system for unexpected file creation. Pay particular attention to any FortiMail interface that is reachable over the network.

Beyond the patch

This is being exploited in the wild, so detection and response matter as much as patching. Our Managed Detection & Response (MDR) and Incident Response Retainer are built for that. Because the flaw is reachable over the network without credentials, a Virtual CISO Services (vCISO) review can help you find and close exposed FortiMail interfaces before the next one.