CVE Details

CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability
Published: 2026-10-01 CVSS: 9.8 CRITICAL Product: Fortinet FortiMail Due Date: 2026-10-04

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.8
  • Severity: CRITICAL
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

SSVC

  • Exploitation: active
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-104286
cveMetadata > assignerOrgId 6abe59d8-c742-4dff-8ce8-9b0ca1073da8
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName fortinet
cveMetadata > dateReserved 2026-10-01T19:12:54.081Z
cveMetadata > datePublished 2026-10-01T19:17:38.938Z
cveMetadata > dateUpdated 2026-10-01T20:10:11.148Z
containers > cna > affected > 0 > vendor Fortinet
containers > cna > affected > 0 > product FortiMail
containers > cna > affected > 0 > cpes > 0 cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 1 cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 2 cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 3 cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 4 cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 5 cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 6 cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 7 cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 8 cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 9 cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 10 cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 11 cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 12 cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 13 cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 14 cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 15 cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 16 cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 17 cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 18 cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 19 cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 20 cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 21 cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 22 cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 23 cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 24 cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 25 cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 26 cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 27 cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 28 cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 29 cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 30 cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 31 cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 32 cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*
containers > cna > affected > 0 > cpes > 33 cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > versions > 0 > version 8.0.0
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 1 > versionType semver
containers > cna > affected > 0 > versions > 1 > version 7.6.0
containers > cna > affected > 0 > versions > 1 > lessThanOrEqual 7.6.5
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 2 > versionType semver
containers > cna > affected > 0 > versions > 2 > version 7.4.0
containers > cna > affected > 0 > versions > 2 > lessThanOrEqual 7.4.6
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 3 > versionType semver
containers > cna > affected > 0 > versions > 3 > version 7.2.0
containers > cna > affected > 0 > versions > 3 > lessThanOrEqual 7.2.9
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 4 > versionType semver
containers > cna > affected > 0 > versions > 4 > version 7.0.0
containers > cna > affected > 0 > versions > 4 > lessThanOrEqual 7.0.9
containers > cna > affected > 0 > versions > 4 > status affected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
containers > cna > providerMetadata > orgId 6abe59d8-c742-4dff-8ce8-9b0ca1073da8
containers > cna > providerMetadata > shortName fortinet
containers > cna > providerMetadata > dateUpdated 2026-10-01T19:29:27.913Z
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-22
containers > cna > problemTypes > 0 > descriptions > 0 > description Execute unauthorized code or commands
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > baseScore 9.8
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
containers > cna > solutions > 0 > lang en
containers > cna > solutions > 0 > value Upgrade to upcoming FortiMail version 8.0.1 or above Upgrade to upcoming FortiMail version 7.6.6 or above Upgrade to upcoming FortiMail version 7.4.8 or above Upgrade to upcoming FortiMail version 7.2.10 or above Upgrade to FortiRecorder version 7.6.1 or above Upgrade to FortiRecorder version 7.2.12 or above Upgrade to upcoming FortiRecorder version 7.0.7 or above
containers > cna > references > 0 > name https://fortiguard.fortinet.com/psirt/FG-IR-26-175
containers > cna > references > 0 > url https://fortiguard.fortinet.com/psirt/FG-IR-26-175
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-104286
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-01T20:02:06.190902Z
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-01T20:10:11.148Z