CVE-2026-104286: FortiMail
This is a record in the CVE List, the public register of security flaws. CISA added it to its list of flaws known to be used by attackers on 1 Oct 2026. The title and any summary are in the source's own words.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
- Kind
- Act now
- Started
- Why we can name the supplier
- An official register says it: a CVE record, CISA's list of exploited flaws or the NCSC
Products it names
- FortiMail (Fortinet)
The latest
We aim to update this thread. For the latest, check the supplier's own page directly: www.cve.org/CVERecord?id=CVE-2026-104286.
This entry comes from our research build of public sources made on 24 Oct 2026.