CVE-2026-104286
KEV: known exploited SSVC: activeFetching some sources has been requested. Reload in about a minute to see them.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vectorThis vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | H | High |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Solutions (CNA)
Upgrade to upcoming FortiMail version 8.0.1 or above Upgrade to upcoming FortiMail version 7.6.6 or above Upgrade to upcoming FortiMail version 7.4.8 or above Upgrade to upcoming FortiMail version 7.2.10 or above Upgrade to FortiRecorder version 7.6.1 or above Upgrade to FortiRecorder version 7.2.12 or above Upgrade to upcoming FortiRecorder version 7.0.7 or above Fortinet remediated this issue in FortiMail Cloud version 25.1 (not released) and hence customers do not need to perform any action.
CISA KEV entry
Fortinet FortiMail Path Traversal Vulnerability — Fortinet / FortiMail
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.1 | 9.8 CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA / fortinet | 3.1 | 9.8 CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiMail | affected: 8.0.0 affected: 7.6.0 … <= 7.6.5 affected: 7.4.0 … <= 7.4.6 affected: 7.2.0 … <= 7.2.9 affected: 7.0.0 … <= 7.0.9 default: unaffected |
NVD CPE (3)
Show CPE list
| Vendor | Product | Range | CPE |
|---|---|---|---|
| fortinet | fortimail | >= 7.2.0, <= 7.4.8 | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* |
| fortinet | fortimail | >= 7.6.0, <= 7.6.6 | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* |
| fortinet | fortimail | >= 8.0.0, <= 8.0.1 | cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* |
Linux distribution status
References (2)
- https://fortiguard.fortinet.com/psirt/FG-IR-26-175 NVD, CNA MitigationVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286 NVD, ADP CISA-ADP US Government Resourcegovernment-resource