Zetlyn
GitHubGet started

Fortinet FortiMail Path Traversal Vulnerability

cve CVE-2026-104286 3 sources, 3 claims · Watch

CISA Known Exploited Vulnerabilities writes:
Fortinet FortiMail Path Traversal Vulnerability Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon… the claim

What it is to other things

affectsfortinet/fortimail
NVD
made_byfortinet
NVD

What each source says

PropertySourceSaidMeans here
Cvss
cvss
GitHub advisories9.8
receipt
Source
GitHub advisories
Its words
9.8
Read by
field:cvss.score
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-05 12:22 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-104286",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-22",
      "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    }
  ],
  "description": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "ghsa_id": "GHSA-6gxc-3vv7-7w24",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6gxc-3vv7-7w24",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6gxc-3vv7-7w24"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-104286"
    }
  ],
  "nvd_published_at": "2026-10-01T20:17:24Z",
  "published_at": "2026-10-01T21:32:52Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
    "https://fortiguard.fortinet.com/psirt/FG-IR-26-175",
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286",
    "https://github.com/advisories/GHSA-6gxc-3vv7-7w24"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...",
  "type": "unreviewed",
  "updated_at": "2026-10-01T21:33:02Z",
  "url": "https://api.github.com/advisories/GHSA-6gxc-3vv7-7w24",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Cvss
cvss
NVD9.8
receipt
Source
NVD
Its words
9.8
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiMail",
            "vendor": "Fortinet",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.0"
              },
              {
                "lessThanOrEqual": "7.6.5",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.9",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.9",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "cisaActionDue": "2026-10-04",
    "cisaExploitAdd": "2026-10-01",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "77C9CE10-1038-4100-81E0-234822E6373B",
                "versionEndIncluding": "7.4.8",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1EA73418-A7A1-4247-BA3E-969550962E0E",
                "versionEndIncluding": "7.6.6",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DDAF1B20-36CA-4DD4-9483-6B605001B9DA",
                "versionEndIncluding": "8.0.1",
                "versionStartIncluding": "8.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests."
      }
    ],
    "id": "CVE-2026-104286",
    "lastModified": "2026-10-02T12:35:33.990",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-104286",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-01T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-01T20:17:24.010",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-22"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Cwe
cwe
GitHub advisoriesCWE-22
receipt
Source
GitHub advisories
Its words
CWE-22
Read by
field:cwes[].cwe_id
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-05 12:22 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-104286",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-22",
      "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    }
  ],
  "description": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "ghsa_id": "GHSA-6gxc-3vv7-7w24",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6gxc-3vv7-7w24",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6gxc-3vv7-7w24"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-104286"
    }
  ],
  "nvd_published_at": "2026-10-01T20:17:24Z",
  "published_at": "2026-10-01T21:32:52Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
    "https://fortiguard.fortinet.com/psirt/FG-IR-26-175",
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286",
    "https://github.com/advisories/GHSA-6gxc-3vv7-7w24"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...",
  "type": "unreviewed",
  "updated_at": "2026-10-01T21:33:02Z",
  "url": "https://api.github.com/advisories/GHSA-6gxc-3vv7-7w24",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Cwes
cwes
CISA Known Exploited VulnerabilitiesCWE-22, CWE-158
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
CWE-22, CWE-158
Read by
field:cwes
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 14:19 UTC
What the source handed over
{
  "cveID": "CVE-2026-104286",
  "cwes": "CWE-22, CWE-158",
  "dateAdded": "2026-10-01",
  "dueDate": "2026-10-04",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
  "product": "FortiMail",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability"
}
—
Due date
due_date
CISA Known Exploited Vulnerabilities2026-10-04
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
2026-10-04
Read by
field:dueDate
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 14:19 UTC
What the source handed over
{
  "cveID": "CVE-2026-104286",
  "cwes": "CWE-22, CWE-158",
  "dateAdded": "2026-10-01",
  "dueDate": "2026-10-04",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
  "product": "FortiMail",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability"
}
—
Exploited
exploited
CISA Known Exploited Vulnerabilitiesyes
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
yes
Read by
const:yes
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 14:19 UTC
What the source handed over
{
  "cveID": "CVE-2026-104286",
  "cwes": "CWE-22, CWE-158",
  "dateAdded": "2026-10-01",
  "dueDate": "2026-10-04",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
  "product": "FortiMail",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability"
}
—
Forensic triage
forensic_triage
CISA Known Exploited Vulnerabilitiestrue
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Yes
Read by
field:forensicTriage
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 14:19 UTC
What the source handed over
{
  "cveID": "CVE-2026-104286",
  "cwes": "CWE-22, CWE-158",
  "dateAdded": "2026-10-01",
  "dueDate": "2026-10-04",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
  "product": "FortiMail",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability"
}
—
Known ransomware campaign use
known_ransomware_campaign_use
CISA Known Exploited VulnerabilitiesUnknown
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Unknown
Read by
field:knownRansomwareCampaignUse
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 14:19 UTC
What the source handed over
{
  "cveID": "CVE-2026-104286",
  "cwes": "CWE-22, CWE-158",
  "dateAdded": "2026-10-01",
  "dueDate": "2026-10-04",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
  "product": "FortiMail",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability"
}
—
Product
product
CISA Known Exploited VulnerabilitiesFortiMail
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
FortiMail
Read by
field:product
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 14:19 UTC
What the source handed over
{
  "cveID": "CVE-2026-104286",
  "cwes": "CWE-22, CWE-158",
  "dateAdded": "2026-10-01",
  "dueDate": "2026-10-04",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
  "product": "FortiMail",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability"
}
—
Product
product
NVDFortiMail
receipt
Source
NVD
Its words
FortiMail
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiMail",
            "vendor": "Fortinet",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.0"
              },
              {
                "lessThanOrEqual": "7.6.5",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.9",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.9",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "cisaActionDue": "2026-10-04",
    "cisaExploitAdd": "2026-10-01",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "77C9CE10-1038-4100-81E0-234822E6373B",
                "versionEndIncluding": "7.4.8",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1EA73418-A7A1-4247-BA3E-969550962E0E",
                "versionEndIncluding": "7.6.6",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DDAF1B20-36CA-4DD4-9483-6B605001B9DA",
                "versionEndIncluding": "8.0.1",
                "versionStartIncluding": "8.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests."
      }
    ],
    "id": "CVE-2026-104286",
    "lastModified": "2026-10-02T12:35:33.990",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-104286",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-01T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-01T20:17:24.010",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-22"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
GitHub advisoriescritical
GitHub's own rating, from the CVSS base score at 9.0 and above.
receipt
Source
GitHub advisories
Its words
critical
Read by
field:severity
Said since
2026-10-02 11:59 UTC
Last answered
2026-10-05 12:22 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-104286",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-22",
      "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    }
  ],
  "description": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "ghsa_id": "GHSA-6gxc-3vv7-7w24",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-6gxc-3vv7-7w24",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-6gxc-3vv7-7w24"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-104286"
    }
  ],
  "nvd_published_at": "2026-10-01T20:17:24Z",
  "published_at": "2026-10-01T21:32:52Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
    "https://fortiguard.fortinet.com/psirt/FG-IR-26-175",
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286",
    "https://github.com/advisories/GHSA-6gxc-3vv7-7w24"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...",
  "type": "unreviewed",
  "updated_at": "2026-10-01T21:33:02Z",
  "url": "https://api.github.com/advisories/GHSA-6gxc-3vv7-7w24",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-10-02 18:03 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
2026-10-02 18:03 UTCAnalyzed
2026-10-02 12:00 UTCAwaiting Analysis
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiMail",
            "vendor": "Fortinet",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.0"
              },
              {
                "lessThanOrEqual": "7.6.5",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.9",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.9",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "cisaActionDue": "2026-10-04",
    "cisaExploitAdd": "2026-10-01",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "77C9CE10-1038-4100-81E0-234822E6373B",
                "versionEndIncluding": "7.4.8",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1EA73418-A7A1-4247-BA3E-969550962E0E",
                "versionEndIncluding": "7.6.6",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DDAF1B20-36CA-4DD4-9483-6B605001B9DA",
                "versionEndIncluding": "8.0.1",
                "versionStartIncluding": "8.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests."
      }
    ],
    "id": "CVE-2026-104286",
    "lastModified": "2026-10-02T12:35:33.990",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-104286",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-01T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-01T20:17:24.010",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-22"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDFortinet
receipt
Source
NVD
Its words
Fortinet
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiMail",
            "vendor": "Fortinet",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.0"
              },
              {
                "lessThanOrEqual": "7.6.5",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.9",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.9",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "cisaActionDue": "2026-10-04",
    "cisaExploitAdd": "2026-10-01",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "77C9CE10-1038-4100-81E0-234822E6373B",
                "versionEndIncluding": "7.4.8",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "1EA73418-A7A1-4247-BA3E-969550962E0E",
                "versionEndIncluding": "7.6.6",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DDAF1B20-36CA-4DD4-9483-6B605001B9DA",
                "versionEndIncluding": "8.0.1",
                "versionStartIncluding": "8.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests."
      }
    ],
    "id": "CVE-2026-104286",
    "lastModified": "2026-10-02T12:35:33.990",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-104286",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-01T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-01T20:17:24.010",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Mitigation",
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-22"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor project
vendor_project
CISA Known Exploited VulnerabilitiesFortinet
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Fortinet
Read by
field:vendorProject
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-05 14:19 UTC
What the source handed over
{
  "cveID": "CVE-2026-104286",
  "cwes": "CWE-22, CWE-158",
  "dateAdded": "2026-10-01",
  "dueDate": "2026-10-04",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286",
  "product": "FortiMail",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.",
  "vendorProject": "Fortinet",
  "vulnerabilityName": "Fortinet FortiMail Path Traversal Vulnerability"
}
—

vulnerability

Fortinet FortiMail Path Traversal Vulnerability
zetlyn/cve-kev · 2026-10-01
cwes CWE-22, CWE-158 due_date 2026-10-04 exploited yes forensic_triage true known_ransomware_campaign_use Unknown product FortiMail vendor_project Fortinet
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
zetlyn/cve-nvd · 2026-10-01
cvss 9.8 product FortiMail status Analyzed vendor Fortinet source
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...
zetlyn/cve-ghsa · 2026-10-01
cvss 9.8 cwe CWE-22 severity critical source