CVE-2026-104286

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-104286 9.8

Fortinet · FortiMail · Added 2026-10-01 · Published 2026-10-01

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityFortinet FortiMail Path Traversal Vulnerability

VendorFortinet

ProductFortiMail

Date added2026-10-01

Due date2026-10-04

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-158 CWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

NVD: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-10-01 20:27 UTC

Wall time0.4s

Searches11

Component defaultno

Sources https://www.fortiguard.com/psirt?cve=CVE-2026-104286
https://fortiguard.fortinet.com/psirt/FG-IR-26-175
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286
https://nvd.nist.gov/vuln/detail/CVE-2026-104286
https://docs.fortinet.com/document/fortimail/8.0.0/administration-guide/286643/configuring-ibe-encryption
https://docs.fortinet.com/document/fortimail/latest/cli-reference/813529/system-encryption-ibe
https://filestore.fortinet.com/fortiguard/psirt/csaf_improper-limitation-of-a-pathname-to-a-restricted-directory_fg-ir-26-175.json

QC notes

warn component_extraction: Component 'FortiMail web GUI IBE (Identity-Based Encryption) portal handlers (config system encryption ibe) that process unauthenticated HTTP/HTTPS requests' matches or contains product name 'FortiMail' — no specific component identified

Hunting hypothesis agent

Look for unauthenticated HTTP/HTTPS requests with ../ traversal and %00 NULL bytes against the FortiMail IBE portal, then hunt event logs for advisory IoCs: cron 'O=/migadmin', archive remote-ip 79.141.169.187, and /data/etc/ld.so.preload.

Research details

ComponentFortiMail web GUI IBE (Identity-Based Encryption) portal handlers (config system encryption ibe) that process unauthenticated HTTP/HTTPS requests

PreconditionsUnauthenticated remote attacker (CVSS PR:N/UI:N) needs network access to the FortiMail HTTP/HTTPS web interface; affected: FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9. Advisory workaround disables the IBE service (CLI default: disable) or restricts management-interface exposure; exploitation reported in the wild. agent

Deliveryunauthenticated crafted HTTP or HTTPS requests exploiting path traversal with a NULL byte against the FortiMail web GUI/IBE portal

Public PoCno

Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-26-175

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Fortinet reports in-the-wild exploitation; no public PoC found in this cycle | Workaround: config system encryption ibe / set status disable, or restrict management-interface access

SummaryFortinet FortiMail is affected by a path traversal (CWE-22) combined with improper NULL-byte neutralization (CWE-158) that lets an unauthenticated attacker write arbitrary files via crafted HTTP/HTTPS requests (CVSS 9.8). Fortinet reports in-the-wild exploitation and published file, IP, and log indicators of compromise. No public proof-of-concept was found in this cycle. Mitigate by upgrading to FortiMail 8.0.2/7.6.7/7.4.9 (or 7.4+ from 7.2), disabling the IBE service, or restricting management-interface access.

Tia coverage

First reported2026-10-01

First exploit report2026-10-02

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.