In short: CVE-2026-104286 is a critical (CVSS 9.8) path traversal vulnerability in Fortinet FortiMail that lets an unauthenticated attacker write arbitrary files to the appliance using crafted HTTP or HTTPS requests. Fortinet has confirmed exploitation in the wild, and CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026. If you run FortiMail, apply the IBE workaround and restrict the management interface now, then upgrade as soon as a fixed build exists for your branch.
What is CVE-2026-104286?
FortiMail is Fortinet’s email security gateway, which means it usually sits at the network edge and is reachable from the internet. Fortinet’s advisory (FG-IR-26-175) maps the flaw to two weaknesses:
- CWE-22 – improper limitation of a pathname to a restricted directory (path traversal)
- CWE-158 – improper neutralization of null bytes
Put together, these let a remote attacker break out of the directory the application expects and drop files elsewhere on the underlying system, without any credentials. An arbitrary file write on a perimeter appliance is dangerous because, depending on which paths are writable, it can often be turned into code execution, persistence or configuration tampering. Fortinet has not published the full attack chain, so treat that escalation as a realistic risk rather than a confirmed detail.
Timeline
- October 1, 2026 – Fortinet publishes FG-IR-26-175; CISA adds the CVE to the KEV catalog.
- October 4, 2026 – Remediation deadline for U.S. federal civilian (FCEB) agencies.
- The issue was found internally by Gwendal Guégniaud of Fortinet’s Product Security team.
Affected and fixed versions
| FortiMail branch | Affected | Fixed in |
|---|---|---|
| 8.0 | 8.0.0 – 8.0.1 | 8.0.2 or later |
| 7.6 | 7.6.0 – 7.6.6 | 7.6.7 or later |
| 7.4 | 7.4.0 – 7.4.8 | 7.4.9 or later |
| 7.2 | 7.2.0 – 7.2.9 | Migrate to 7.4 or later |
When the advisory was released, the fixed builds were announced as upcoming, so check FortiGuard for current availability before planning your change window.
Is it being exploited?
Yes. Fortinet states the vulnerability has been exploited in the wild, which is also why CISA listed it in KEV. Fortinet has not said who is behind the attacks, how many devices were hit, or when the activity started. The advisory does include indicators of compromise (files, IP addresses and log entries) that administrators can use to check their appliances.
How to mitigate CVE-2026-104286
- Confirm your version. Check the firmware version of every FortiMail appliance and VM against the table above.
- Disable IBE (identity-based encryption) as a temporary workaround if you cannot upgrade yet:
config system encryption ibe set status disable end - Restrict the management interface. Block administrative access from the internet and allow it only from a trusted internal network or jump host.
- Upgrade to 8.0.2, 7.6.7 or 7.4.9 (or later) once available. If you are still on 7.2, plan the move to a supported branch.
- Hunt for compromise using the IoCs listed in FG-IR-26-175, especially if the appliance was exposed before you applied the workaround.
Detection tips for defenders
Fortinet has not released detection signatures publicly, so the following is general guidance for path traversal and file-write bugs on appliances:
- Review web and admin access logs for traversal patterns such as
../, URL-encoded variants like%2e%2e%2f, and null bytes (%00). - Look for unexpected files, scripts or modified configuration on the appliance after the exposure window.
- Forward FortiMail logs to your SIEM so you can correlate suspicious requests with outbound connections from the gateway.
- If you find signs of compromise, treat the device as untrusted: rebuild from a clean image, rotate credentials and review mail flow rules.
Why this matters
Email gateways and other edge devices remain a favorite target because they are internet-facing, highly privileged and often patched less often than servers. Following KEV additions is one of the simplest ways to decide what to patch first. For another recent critical bug analysis, see our breakdown of PHP2Shell (CVE-2026-109618 and CVE-2026-109619).