CVE-2026-104286 – Fortinet FortiMail
“When attackers can write any file to your mail gateway without logging in, every message in your organization is in their hands.”
Fortinet has released a fix for a path traversal vulnerability in FortiMail. The flaw affects FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files on the underlying system, which can lead to elevation of privilege. CVE-2026-104286 has a CVSS score of 9.8, Critical severity.
Attackers are actively exploiting CVE-2026-104286. FortiMail sits at the edge of the network and handles all inbound and outbound email, so a compromised gateway exposes sensitive communications and gives attackers a foothold for further compromise. Apply the update immediately.
Key Details
- Affected Product
- Fortinet Fortimail
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-22