- Critical 9.8
- Known exploited (CISA KEV)
CVE-2026-104286
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Scores
The facts
- Published
- 1 October 2026
- Last changed
- 7 October 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.8 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- Affects
- fortinet fortimail
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 1 October 2026.
- EPSS
- 2.2% chance of exploitation activity in the next 30 days (percentile 82).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.