CVE-2026-104286 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-01

Added to CISA KEV: 2026-10-01 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
IMMEDIATE (Priority 1): Upgrade FortiMail to a patched version without delay — FortiMail 8.0.1+, 7.6.6+, 7.4.8+, or 7.2.10+ as specified in the Fortinet PSIRT advisory FG-IR-26-175.
IMMEDIATE (Priority 1): If patching cannot be applied immediately, restrict access to the FortiMail HTTPS/HTTP management interface and user-facing web portal to trusted IP ranges only via firewall ACLs or Fortinet's own trusted host configuration.
URGENT: Review web server and application logs on FortiMail appliances for anomalous HTTP/HTTPS requests containing path traversal sequences (e.g., '../', '%2e%2e%2f', '%252e%252e%252f') targeting unexpected file paths.
URGENT: Audit recently modified files on FortiMail systems, particularly in web-accessible directories, for unauthorized web shells or backdoors.
HIGH: Check for unexpected outbound connections from FortiMail appliances that could indicate post-exploitation C2 activity.
HIGH: Verify system integrity by comparing file hashes of critical system binaries and configuration files against known-good baselines.
Monitor Fortinet PSIRT (https://fortiguard.fortinet.com/psirt) and threat intelligence feeds for any emerging PoC or active exploitation reports — historical Fortinet CVEs have been weaponized within days of disclosure.
Patch Priority: CRITICAL — treat as P0/emergency patch given unauthenticated RCE potential, internet-facing nature of the product, CISA 'Automatable: yes' rating, and Fortinet's track record as a high-value target for nation-state and ransomware actors.

🔍 Web Intelligence (Kagi · 2026-10-01)

Summary

CVE-2026-104286 is a path traversal vulnerability affecting multiple versions of Fortinet FortiMail. This vulnerability stems from an improper limitation of pathnames to a restricted directory, which allows an unauthenticated, remote attacker to write arbitrary files onto the underlying system through crafted HTTP or HTTPS requests. Because this flaw enables unauthenticated remote code execution or system configuration tampering, it poses a severe security risk to affected appliances.

Exploitation

Active Exploitation: There are currently no reports of widespread active exploitation of this CVE in the wild.
Threat Actors/Campaigns: No specific threat actors or ransomware campaigns have been publicly linked to this vulnerability.
Proof-of-Concept: No public proof-of-concept (PoC) exploit code or automated attack tools are currently widely available.
Attack Prerequisites:

- The attack is network-based and can be performed remotely. - No authentication is required to initiate the attack. - No user interaction is required from a legitimate user.

Affected Products & Patches

Affected Product Versions:

- FortiMail 8.0.0 through 8.0.1 - FortiMail 7.6.0 through 7.6.6 - FortiMail 7.4.0 through 7.4.8 - FortiMail 7.2.0 through 7.2.9

Patches/Hotfixes: Users should refer to the official [Fortinet PSIRT Advisories](https://www.fortiguard.com/psirt) page for the latest firmware versions that address this vulnerability and upgrade immediately.
Mitigations/Workarounds: If an immediate upgrade is not possible, organizations should restrict management interface access to trusted networks only and monitor traffic for suspicious HTTP/HTTPS requests containing directory traversal sequences.

Impact

Access/Capability: Successful exploitation grants the attacker the ability to write arbitrary files to the FortiMail system, which can lead to full system compromise, the installation of backdoors, or the modification of critical system files.
Business Risk: For internet-facing deployments, this vulnerability is critical. An attacker could completely take over the email security gateway, leading to the interception of sensitive corporate communications, disruption of email services, or use of the compromised appliance as a beachhead to attack internal network resources. ^[1]

Sources

CVE-2026-104286 - Vulnerability Details - OpenCVE
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the…

🔴 CVE-2026-104286