CVE-2026-104286 Fortinet FortiMail Path Traversal

Exploited in the wild Critical 9.8 Published 1 Oct 2026 Updated 28 Oct 2026

Unauthenticated attackers can write arbitrary files on FortiMail systems via crafted HTTP requests, potentially leading to code execution.

Exploited in the wild: Since 1 Oct 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-104286?

CVE-2026-104286 is a critical path traversal vulnerability in Fortinet FortiMail, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Weakness: CWE-22

Which versions are affected by CVE-2026-104286?

It affects 1 product.

Products include Fortinet Fortimail.

How do I fix CVE-2026-104286?

No fix has been published for CVE-2026-104286 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 4 Oct 2026.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-104286 being exploited?

Yes. Attackers have exploited CVE-2026-104286 in the wild since at least 1 Oct 2026.

Public exploit code: 5 proofs of concept on GitHub.

Sources

Also known as GHSA-6gxc-3vv7-7w24.