Critical
FortiMail, Fortinet, CVE-2026-104286, zero-day, path traversal, arbitrary file write, CISA KEV, email security
FortiMail CVE-2026-104286: Exploited Zero-Day File Write
FortiMail CVE-2026-104286 is a CVSS 9.8 unauthenticated arbitrary file write (path traversal), an exploited zero-day in CISA KEV. Affected versions and fix.
FortiMail CVE-2026-104286 is a critical path-traversal flaw (CVSS 9.8, CWE-22) that lets an unauthenticated attacker write arbitrary files on a FortiMail appliance through crafted HTTP or HTTPS requests. It is a zero-day already exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on October 1, 2026 with a federal remediation deadline of October 4, so upgrade to a fixed FortiMail build immediately.
FortiMail is Fortinet's email security gateway, the appliance organizations put in front of their mail to filter spam, phishing, and malware. An unauthenticated arbitrary-file-write on that device is dangerous precisely because file-write primitives are rarely the end of the story: dropping a file into the right location on an appliance is a common path to a web shell, persistence, or code execution. According to The Hacker News and SecurityWeek, Fortinet's own product security researcher Gwendal Guégniaud found the flaw, and it is being actively exploited.
The vulnerability combines a path traversal (CWE-22) with improper neutralization of a null byte or special character (CWE-158), and it is reachable over the network with no authentication. That combination, network-reachable, unauthenticated, and on a security appliance that sits in the mail path, is why it carries a 9.8 and why CISA moved it into KEV within a day. It also continues a long run of attackers targeting Fortinet edge devices, where a single foothold sees a great deal of traffic.
What is CVE-2026-104286 and how does the attack work?
CVE-2026-104286 is an unauthenticated arbitrary-file-write vulnerability in FortiMail. An attacker sends a crafted HTTP or HTTPS request whose path escapes the intended directory, letting them write a file of their choosing to the underlying system. Because no credentials or user interaction are required, the barrier to exploitation is simply reaching the appliance's web interface. From an arbitrary file write, an attacker's typical next move is to plant executable content and turn the write into code execution, which is why Fortinet and CISA are treating it as urgent despite the advisory describing the direct impact as a file write.
Which FortiMail versions are affected and fixed?
Affected FortiMail versions | Fixed version |
|---|---|
8.0.0 through 8.0.1 | 8.0.2 or above |
7.6.0 through 7.6.6 | 7.6.7 or above |
7.4.0 through 7.4.8 | 7.4.9 or above |
7.2.0 through 7.2.9 | Upgrade to 7.4.9 or a fixed branch |
Upgrade to a fixed build now, and because exploitation is confirmed, treat any internet-reachable FortiMail management interface as potentially targeted. Restrict administrative access to trusted networks, and review the appliance for unexpected files in web-accessible directories and other signs of compromise.
Is CVE-2026-104286 being actively exploited?
Yes. Fortinet confirmed in-the-wild exploitation, and CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities catalog on October 1, 2026, setting a remediation deadline of October 4. EPSS already places it around the 82nd percentile. When a flaw is unauthenticated, network-reachable, and confirmed exploited on an internet-facing security appliance, the window for a scheduled patch has already closed.
Our read
An email security gateway is a control, and this is the recurring lesson that controls are attack surface too, especially the edge appliances that see everything. The honest question a KEV listing forces is not whether you run FortiMail but whether you can prove, today, which of your appliances are on a fixed build and whether your logs would surface a crafted request that wrote where it should not. That is a continuous-verification problem: exercise the exposed path the way an attacker would, then confirm the fix landed rather than assuming the fleet is current. In our analysis of the 2025 KEV catalog, roughly two in three actively exploited flaws would have been missed by an annual pentest; a three-day federal deadline on an unauthenticated edge file-write is that gap in real time.
Reporting by The Hacker News and SecurityWeek; CVSS 9.8, CWE-22/CWE-158, affected builds, and KEV status per Fortinet's advisory and the CISA KEV catalog. Sources linked above.
Frequently asked questions
What is CVE-2026-104286?
It is a critical path-traversal vulnerability (CVSS 9.8, CWE-22) in Fortinet FortiMail that lets an unauthenticated attacker write arbitrary files to the appliance via crafted HTTP or HTTPS requests.
Is CVE-2026-104286 being exploited?
Yes. It is an exploited zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on October 1, 2026, with a remediation deadline of October 4.
How do I fix CVE-2026-104286?
Upgrade FortiMail to a fixed build: 8.0.2 or above, 7.6.7 or above, 7.4.9 or above, and move 7.2.x systems onto a fixed branch. Restrict management access to trusted networks while you patch.
What can an arbitrary file write lead to?
On an appliance, writing a file to a web-accessible or executable location is a common route to a web shell, persistence, or code execution, which is why this is treated as critical despite the direct impact being a file write.