plaincve:~$

// threat brief

CVE-2026-104286Actively exploited

FortiMail path traversal: unauthenticated attackers may be able to write arbitrary files, exploited in the wild, fixed releases listed on Oct 5

CVSS
9.8 CRITICAL
CISA KEV
2026-10-01
Weakness
CWE-22 · CWE-158
Topics
Infrastructure

PlainCVE Team · Published 2026-10-07 · AI-assisted · Press brief ↓

AI review 2026-10-07 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

FortiMail flaw may let unauthenticated attackers write arbitrary files via crafted web requests; exploited in the wild; Fortinet listed fixes on 2026-10-05.

Who is affectedTwo Fortinet primary sources disagree: Fortinet's advisory lists FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9; the CVE record Fortinet filed as CNA lists, in its structured data, 8.0.0, 7.6.0–7.6.5, 7.4.0–7.4.6, 7.2.0–7.2.9 and also 7.0.0–7.0.9. Check any version listed as affected by either source (including 7.0.0–7.0.9); see the page body.
What happensAn attacker may be able to write arbitrary files on the appliance's underlying system; Fortinet lists the impact category as executing unauthorized code or commands.
What to do nowUpgrade to a release both Fortinet sources treat as fixed: 8.0.2, 7.6.7 or 7.4.9 or later (the advisory says 7.2 users move to the 7.4 branch or later; PlainCVE's analysis is that this must be 7.4.9 or later, since 7.4.0–7.4.8 is itself affected; the CVE record also lists 7.0 as affected, and neither source lists a 7.0 fix, so PlainCVE suggests 7.0 users likewise move to a fixed release such as 7.4.9 or later). If you cannot upgrade right away, apply Fortinet's workarounds: disable the IBE feature, allow webmail interface access only from a trusted private network, or use a WAF to block the requests to /ibe described in the advisory. Check Fortinet's published indicators of compromise.
Affected versions8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9 (Fortinet advisory); the CVE record's structured data also lists 7.0.0–7.0.9 and uses different upper bounds
Fixed versions8.0.2, 7.6.7 and 7.4.9 or later (Fortinet advisory, updated 2026-10-05); 7.2 users must move to the 7.4 branch or later (Fortinet advisory); PlainCVE's analysis: this only helps at 7.4.9 or later. The CVE record's solution field instead says 8.0.1, 7.6.6, 7.4.8, 7.2.10 or later; neither source lists a 7.0 fix
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2026-10-01
CISA KEVListed (2026-10-01): attacks have been seen in the wild

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your version against both Fortinet sources

    Fortinet's advisory lists 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9; the CVE record Fortinet filed also lists 7.0.0–7.0.9 in its structured data. PlainCVE's suggestion: treat any version in either range (7.0.0–7.0.9, 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, 8.0.0–8.0.1) as needing action. NVD's own CPE configuration matches the advisory and does not include 7.0. Suped warns that the CVE record's machine-readable version data conflicts with the advisory, so relying only on a scanner or cached feed can lead to the wrong decision.

  2. 02Check for Fortinet's indicators of compromise

    Fortinet's current advisory lists IP addresses tied to the attacks (79.141.169.187, 45.129.0.192) and sample System Event Log and Encryption Log entries. Use the full list in the advisory.

    Read-only check
    grep -E '79\.141\.169\.187|45\.129\.0\.192' exported-fortimail-logs.txt
    Step 1Step 3Step 4
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Disable the IBE feature (official workaround)

    If you cannot upgrade right away, Fortinet's workaround is to disable IBE feature support from the GUI or CLI; see the advisory for the exact steps.

    Step 2
  2. 02Restrict webmail interface access or filter with a WAF (official alternative)

    Fortinet's alternatives: block internet access to the FortiMail webmail interface, or allow access only from a trusted private network; or use a WAF to block the POST requests to /ibe described in the advisory. PlainCVE's analysis: restricting only the management interface may leave the webmail interface exposed (Fortinet's advisory does not say this).

    Step 1
  3. 03Upgrade to a fixed release

    Fortinet's advisory (updated 2026-10-05) lists 8.0.2, 7.6.7 and 7.4.9 or later, which both Fortinet sources treat as fixed. 7.2 users must move to the 7.4 branch or later; our analysis is that this only helps at 7.4.9 or later. The CVE record also lists 7.0.0–7.0.9 as affected, but neither source lists a 7.0 fix; PlainCVE's suggestion is that 7.0 users move to a release both sources treat as fixed (for example 7.4.9 or later). For FortiMail Cloud, two Fortinet primary sources differ. Fortinet's advisory (2026-10-07 clarification) says the cloud firmware was updated to 7.6.7 GA or 8.0.2 GA on 10-05, while the solution field of the CVE record Fortinet filed (updated 2026-10-07) says the issue was remediated in FortiMail Cloud version 25.1 (not released). Both say cloud customers need not take action.

    Step 2
RESPONDRespondIf you find signs of compromise
  1. 01Treat a device with indicators as possibly compromised

    PlainCVE's suggestion: preserve logs and investigate against the full indicator list in the advisory. The sources behind this page do not describe official cleanup steps. Suped notes that file write does not prove code ran on every device, but that is no reason to assume a device is clean.

    Step 3Step 4
HARDENHardenPrevent the next one
  1. 01Keep unneeded web interfaces off the internet

    PlainCVE's suggestion: Fortinet's alternative workaround here is to restrict the webmail interface; exposing only the web interfaces you need (including webmail and management) long term shrinks exposure to similar flaws.

    Step 1
  2. 02Check both the vendor advisory and the CVE record

    Suped points out that machine-readable CVE data can differ from the vendor advisory. PlainCVE's suggestion: check inventory against both the vendor advisory and the CVE record, and act on any version either one lists as affected.

Full remediation steps and notes

Fortinet’s advisory (updated 2026-10-05) now lists fixed releases: upgrade to 8.0.2, 7.6.7 or 7.4.9 or later, and check for indicators of compromise. If you cannot upgrade right away, apply a workaround first:

  • Disabling IBE: Fortinet’s advisory gives GUI and CLI ways to do this; take them directly from the advisory.
  • Restrict the webmail interface: block internet access to the webmail interface, or allow it only from a trusted private network (Fortinet). PlainCVE’s analysis: restricting only the management interface is not enough (Fortinet’s advisory does not say this).
  • WAF: use a WAF to block the POST requests to /ibe described in the advisory (Fortinet).
  • 7.2 users: Fortinet says to move to the 7.4 branch or later, but 7.4.0–7.4.8 is itself affected. Our analysis (Suped makes the same point): moving from 7.2 to 7.4 only helps at 7.4.9 or later.
  • 7.0 users: the CVE record lists 7.0.0–7.0.9 as affected, the advisory does not; neither source lists a 7.0 fix. PlainCVE’s suggestion: 7.0 users should check too and move to a release both sources treat as fixed (for example 7.4.9 or later).
  • FortiMail Cloud: two Fortinet primary sources differ. Fortinet’s advisory (2026-10-07 clarification) says the cloud firmware was updated to 7.6.7 GA or 8.0.2 GA on 10-05; the solution field of the CVE record Fortinet filed (updated 2026-10-07) says “Fortinet remediated this issue in FortiMail Cloud version 25.1 (not released)”. Both say cloud customers need not take action.
  • The CVE record’s fix guidance differs from the advisory:
BranchCVE record solution textFortinet advisory
8.08.0.1 or later8.0.1 is affected; fix is 8.0.2
7.67.6.6 or later7.6.6 is affected; fix is 7.6.7
7.47.4.8 or later7.4.8 is affected; fix is 7.4.9
7.2Upcoming 7.2.10Move to the 7.4 branch

The releases both sources treat as fixed are 8.0.2, 7.6.7 and 7.4.9 or later; 8.0.1, 7.6.6 and 7.4.8, named in the CVE record, are still listed as affected in the advisory, so PlainCVE suggests not stopping at those. The CVE record’s solution text also mentions FortiRecorder versions, but no FortiRecorder product is listed as affected; whether FortiRecorder is affected is unconfirmed and may be a copy error.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

FortiMail path traversal: unauthenticated attackers may be able to write arbitrary files, exploited in the wild, fixed releases listed on Oct 5: 1. Sends crafted HTTP/HTTPS requests to FortiMail → 2. The appliance fails to keep the file path inside the allowed folder → 3. The attacker writes arbitrary files on the underlying system → 4. May go on to run unauthorized code or commandsCVE-2026-104286 · FortiMail path traversal: unauthenticated attackers may be able towrite arbitrary files, exploited in the wild, fixed releases listed on Oct 5AttackerYour systemSends crafted HTTP/HTTPS requests to FortiMail — No login is needed. Fortinet's workarounds target the webmail interface and the /ibe endpoint, indicating the attacker must be able to reach that interface (BleepingComputer, quoting the advisory as first published, says management interface; the current advisory says webmail interface). 1Sends craftedHTTP/HTTPSrequests toFortiMailThe appliance fails to keep the file path inside the allowed folder — The weakness is path traversal (CWE-22) combined with improper handling of NULL bytes (CWE-158). Third-party analysis (hol.org) says the vulnerable component backs IBE (Identity Based Encryption); Fortinet does not explicitly say IBE must be enabled. 2The appliancefails to keep thefile path insidethe allowed folderThe attacker writes arbitrary files on the underlying system — Arbitrary file write is the impact Fortinet describes; the current advisory does not list specific files written. 3The attackerwrites arbitraryfiles on theunderlying systemMay go on to run unauthorized code or commands — Fortinet lists the impact category as executing unauthorized code or commands. Suped cautions that file write alone does not prove code ran on every target. 4May go on to rununauthorized codeor commandsAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-104286-fortimail-path-traversal-file-write · CC BY 4.0
FortiMail path traversal: unauthenticated attackers may be able to write arbitrary files, exploited in the wild, fixed releases listed on Oct 5: 1. Sends crafted HTTP/HTTPS requests to FortiMail → 2. The appliance fails to keep the file path inside the allowed folder → 3. The attacker writes arbitrary files on the underlying system → 4. May go on to run unauthorized code or commandsCVE-2026-104286 · FortiMail pathtraversal: unauthenticated attackers maybe able to write arbitrary files,exploited in the wild, fixed release…Sends crafted HTTP/HTTPS requests to FortiMail — No login is needed. Fortinet's workarounds target the webmail interface and the /ibe endpoint, indicating the attacker must be able to reach that interface (BleepingComputer, quoting the advisory as first published, says management interface; the current advisory says webmail interface). 1AttackerSends crafted HTTP/HTTPSrequests to FortiMailThe appliance fails to keep the file path inside the allowed folder — The weakness is path traversal (CWE-22) combined with improper handling of NULL bytes (CWE-158). Third-party analysis (hol.org) says the vulnerable component backs IBE (Identity Based Encryption); Fortinet does not explicitly say IBE must be enabled. 2Your systemThe appliance fails to keep thefile path inside the allowedfolderThe attacker writes arbitrary files on the underlying system — Arbitrary file write is the impact Fortinet describes; the current advisory does not list specific files written. 3Your systemThe attacker writes arbitraryfiles on the underlying systemMay go on to run unauthorized code or commands — Fortinet lists the impact category as executing unauthorized code or commands. Suped cautions that file write alone does not prove code ran on every target. 4AttackerMay go on to run unauthorizedcode or commandsAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-104286-fortimail-path-traversal-file-write
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    Sends crafted HTTP/HTTPS requests to FortiMail

    No login is needed. Fortinet's workarounds target the webmail interface and the /ibe endpoint, indicating the attacker must be able to reach that interface (BleepingComputer, quoting the advisory as first published, says management interface; the current advisory says webmail interface).

    Defense: One of Fortinet's workarounds: block internet access to the webmail interface, or allow it only from a trusted private network; or use a WAF to block the POST requests to /ibe described in the advisory.

  2. Your system

    The appliance fails to keep the file path inside the allowed folder

    The weakness is path traversal (CWE-22) combined with improper handling of NULL bytes (CWE-158). Third-party analysis (hol.org) says the vulnerable component backs IBE (Identity Based Encryption); Fortinet does not explicitly say IBE must be enabled.

    Defense: Upgrade to the fixed releases listed by Fortinet (8.0.2, 7.6.7, 7.4.9 or later); workaround: disable IBE feature support from the GUI or CLI.

  3. Your system

    The attacker writes arbitrary files on the underlying system

    Arbitrary file write is the impact Fortinet describes; the current advisory does not list specific files written.

    Defense: Check for the IP addresses and sample log entries (System Event Logs, Encryption Logs) in Fortinet's advisory.

  4. Attacker

    May go on to run unauthorized code or commands

    Fortinet lists the impact category as executing unauthorized code or commands. Suped cautions that file write alone does not prove code ran on every target.

Who is affected

FortiMail is Fortinet’s email security appliance. Two Fortinet primary sources disagree on the affected versions; the table lists both with their sources:

BranchAffected (Fortinet advisory FG-IR-26-175)Affected (structured data in the CVE record Fortinet filed)Fixed (Fortinet advisory)
8.08.0.0–8.0.18.0.08.0.2 or later
7.67.6.0–7.6.67.6.0–7.6.57.6.7 or later
7.47.4.0–7.4.87.4.0–7.4.67.4.9 or later
7.27.2.0–7.2.97.2.0–7.2.9No 7.2 fix listed; move to the 7.4 branch or later
7.0Not listed7.0.0–7.0.9Neither source lists a 7.0 fix

The fixed versions follow Fortinet’s 2026-10-05 “Solution update” to the advisory; Fortinet’s documentation site also has release notes for 8.0.2, 7.6.7 and 7.4.9 (dated 2026-10-05). BleepingComputer reported, when the advisory first came out, that no security updates were available yet for 7.4, 7.6 and 8.0; that is no longer current.

The sources disagree. The machine-readable version data in the CVE record (filed by Fortinet as CNA; still the case after its 2026-10-07 update) does not match Fortinet’s advisory: it also marks 7.0.0–7.0.9 as affected (neither the advisory nor the CVE text mentions 7.0), ends 7.4 at 7.4.6 and 7.6 at 7.6.5, and lists only 8.0.0 for 8.0. NVD’s own CPE configuration matches the advisory (7.2.0–7.4.8, 7.6.0–7.6.6, 8.0.0–8.0.1) and does not include 7.0. Suped points this out too and warns that an inventory based only on a scanner or cached feed can lead to the wrong remediation decision. PlainCVE’s suggestion: treat any version in either source’s range (including 7.0.0–7.0.9) as needing action.

Preconditions: no login is needed (Fortinet); the attacker must be able to send HTTP/HTTPS requests to the appliance (Fortinet); Fortinet’s current advisory’s workarounds target the webmail interface and POST requests to /ibe (BleepingComputer, quoting the advisory as first published, says management interface; the current advisory says webmail interface). Third-party analysis (hol.org) says the vulnerable component backs IBE (Identity Based Encryption), and Fortinet’s “disable IBE” workaround points the same way, but Fortinet does not explicitly say IBE must be enabled for a device to be vulnerable.

How it works

Fortinet describes the weakness as a combination of two problems: path traversal (CWE-22, failing to keep a file path inside the allowed folder) and improper handling of NULL bytes (CWE-158). A NULL byte is a special character many programs treat as “the string ends here”; if the code that checks a filename and the code that writes the file interpret it differently, the check can be bypassed. Fortinet has not published the specific faulty code; the example below only illustrates this class of flaw in general.

The flawed approach (conceptual illustration, not FortiMail code):

Show code example(python)
name = request_filename            # comes from the outside request
path = BASE_DIR + "/" + name       # joined directly, no check for ".." or NULL bytes
write_file(path, data)

The fixed approach:

Show code example(python)
if "\x00" in name:
    reject()
path = os.path.realpath(os.path.join(BASE_DIR, name))
if not path.startswith(os.path.realpath(BASE_DIR) + os.sep):
    reject()                        # after resolving, it must still be inside the allowed folder
write_file(path, data)

The result is that an attacker may be able to write arbitrary files on the appliance’s underlying system. Fortinet lists the impact category as executing unauthorized code or commands, and the CVSS 3.1 score is 9.8. Suped cautions that arbitrary file write is a serious integrity risk but does not by itself prove that every exposed appliance was compromised or had code run on it.

Timeline

DateEvent
UnknownWhen attacks began has not been disclosed
2026-10-01Fortinet publishes advisory FG-IR-26-175, saying the flaw has been reported exploited in the wild
2026-10-01CVE record published (19:17 UTC)
2026-10-01CISA adds it to the Known Exploited Vulnerabilities (KEV) catalog
2026-10-04KEV remediation due date for US federal agencies
2026-10-05Fortinet updates the advisory’s solution (“Solution update”), listing fixed releases 8.0.2, 7.6.7 and 7.4.9 or later
2026-10-07Fortinet adds a clarification to the advisory that FortiMail Cloud was updated to 7.6.7 GA or 8.0.2 GA on 10-05 and customers need not take action; the CVE record is updated the same day, its structured data still lists 7.0.0–7.0.9, and its solution field says FortiMail Cloud was remediated in version 25.1 (not released), with no customer action needed

Further reading

  • Scoring: CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), supplied by Fortinet PSIRT and shown in NVD.
  • “Zero-day” is BleepingComputer’s term; Fortinet’s advisory does not use it. BleepingComputer and Suped reported that fixes were still “upcoming” when the advisory first came out; the current advisory was revised on 10-05, so the original text cannot be confirmed at the source.
  • Fortinet has not disclosed when attacks began, how many systems were compromised or who is behind them; KEV lists known ransomware use as “Unknown”.
  • The flaw was found internally by Fortinet’s Product Security team.
  • The sources do not say which version or code change introduced the flaw.
  • Related weakness types: CWE-22, CWE-158.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-07 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. AdvisoryFG-IR-26-175 — FortiMail path traversal and NULL byte vulnerability · Fortinet PSIRT, 2026-10-01 · accessed 2026-10-02
  2. CVE / NVD / OSVCVE-2026-104286 Record (CVE API) · CVE Program, 2026-10-01 · accessed 2026-10-02
  3. CVE / NVD / OSVNVD API - CVE-2026-104286 · NIST · accessed 2026-10-02
  4. NewsFortinet warns of critical FortiMail flaw exploited in zero-day attacks · BleepingComputer · accessed 2026-10-02
  5. ResearchCISA flags active exploitation of FortiMail CVE-2026-104286 · Suped · accessed 2026-10-02
  6. ResearchCVE-2026-104286: FortiMail path traversal in KEV · hol.org · accessed 2026-10-02

Press brief

In one sentence

FortiMail is Fortinet's email security appliance. On October 1, 2026, Fortinet disclosed a path traversal flaw (CVE-2026-104286) that may let an unauthenticated attacker write arbitrary files on the device, and said it has been reported to be exploited in the wild. The US agency CISA added it to its Known Exploited Vulnerabilities catalog the same day. On October 5, Fortinet updated the advisory to list fixed releases 8.0.2, 7.6.7 and 7.4.9 or later.

Key facts

Severity
CVSS 3.1 9.8 (Critical) services.nvd.nist.gov
Fortinet advisory
FG-IR-26-175, published 2026-10-01 fortiguard.fortinet.com
Affected versions (Fortinet advisory)
8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9 fortiguard.fortinet.com
Affected versions (CVE record structured data)
8.0.0, 7.6.0–7.6.5, 7.4.0–7.4.6, 7.2.0–7.2.9, 7.0.0–7.0.9 cveawg.mitre.org
Fix status
Fixed releases listed — 8.0.2, 7.6.7, 7.4.9 or later (advisory updated 2026-10-05) fortiguard.fortinet.com
Found by
Fortinet Product Security team, internally fortiguard.fortinet.com

Confirmed

  • Fortinet confirms an unauthenticated attacker may write arbitrary files on the device via crafted HTTP/HTTPS requests.
  • Fortinet says it has been reported exploited in the wild; CISA added it to KEV on 2026-10-01.
  • Fortinet updated its advisory on 2026-10-05 to list fixed releases 8.0.2, 7.6.7 and 7.4.9 or later (7.2 users move to the 7.4 branch or later).

Unconfirmed / disputed

  • Whether the original October 1 advisory listed the fixes as 'upcoming': the current advisory has been revised and the original text cannot be read at the source; this claim comes from secondary reports (BleepingComputer, Suped), and the CVE record's solution field also says 'upcoming' but with different version numbers than the advisory.
  • Fortinet has not disclosed when attacks began, how many systems were hit, or who is behind them; KEV lists ransomware use as 'Unknown'.
  • The CVE record's version and fix data disagree with Fortinet's advisory and mention FortiRecorder; whether FortiRecorder is affected is unconfirmed.
  • The term 'zero-day' comes from BleepingComputer's report; Fortinet's advisory does not use it.
  • Fortinet does not explicitly say IBE must be enabled for a device to be vulnerable.

Quotable line

PlainCVE's advice: Fortinet has listed fixed releases, so upgrade soon; if you cannot upgrade right away, follow the advisory to disable IBE, restrict webmail interface access, or filter with a WAF.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "FortiMail path traversal: unauthenticated attackers may be able to write arbitrary files, exploited in the wild, fixed releases listed on Oct 5". PlainCVE. https://plaincve.date/en/vulns/cve-2026-104286-fortimail-path-traversal-file-write (accessed YYYY-MM-DD)
BibTeX
@misc{cve2026104286fortimailpathtraversalfilewrite2026,
  title  = {FortiMail path traversal: unauthenticated attackers may be able to write arbitrary files, exploited in the wild, fixed releases listed on Oct 5},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-104286-fortimail-path-traversal-file-write},
  note   = {Updated 2026-10-07}
}