cyfenced.com →

[ CVE-2026-104286 · Published 1 Oct 2026 ]

Unauthenticated file write in Fortinet FortiMail

Exploited · CISA KEV CVSS 9.8 EPSS 2%3 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-01
  • Critical severity: CVSS 9.8

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited, and it needs no credentials or user action.

Red alert if
You run FortiMail on an affected version with its web interface reachable from the internet.
Can wait if
You do not use FortiMail, or you already run the fixed release.
What it is
A path traversal flaw in Fortinet FortiMail lets an attacker write arbitrary files on the system through crafted HTTP or HTTPS requests, without logging in. FortiMail 8.0, 7.6, 7.4, 7.2 and older 7.0 releases are affected.
Impact
Anyone who can reach the FortiMail web interface can write files on it, which can lead to full control of the email gateway. That gives an attacker access to the email flowing through it and the ability to weaken spam and malware filtering.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends crafted requests to the FortiMail web interface.
  2. T1505.003 Server Software Component: Web ShellWritten files can give them persistent code execution on the appliance.
  3. T1114 Email CollectionEmail passing through the gateway can be read.
  4. T1562 Impair DefensesMail filtering can be weakened so later phishing gets through.

What to do

  1. Upgrade FortiMail to the fixed release for your branch listed in Fortinet advisory FG-IR-26-175.
  2. Restrict access to the FortiMail administration and web interfaces to trusted addresses.
  3. Check the appliance for unknown files, configuration changes and administrator accounts, following Fortinet's guidance.
  4. If you find signs of compromise, restore a clean configuration and rotate its administrator and integration credentials.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

CISA: Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 4 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References