First published 10/1/2026, 8:31:15 PM · Last updated 10/1/2026, 8:31:15 PM

CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

Fortinet FortiMail contains a path traversal and NULL-byte vulnerability that may allow an unauthenticated attacker to write arbitrary files via crafted HTTP or HTTPS requests. The source directs stakeholders to apply vendor mitigations and follow CISA BOD 26-04 and forensics triage guidance, or discontinue product use if mitigations are unavailable.

Illustrative image: Distinctive ice cream stand outside Computer Museum and Children's Museum, Boston, Massachusetts — Highsmith, Carol M., 1946-/Library of Congress, Free to Use and Reuse

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 6/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 3/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 4/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 2/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 6/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Why it matters

May allow unauthenticated attackers to write arbitrary files on affected systems, so organizations must implement the vendor and CISA mitigation guidance.

Location

Sources

CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability

Report an issue