DEV Community

SorrelThorncroft
SorrelThorncroft

Posted on

CVE-2026-104286: FortiMail Path Traversal Under Active Exploitation

#vulnerability #fortinet #fortimail #cve2026104286

CVE-2026-104286: FortiMail Path Traversal Under Active Exploitation

Vulnerability overview

CVE-2026-104286 is a critical path traversal vulnerability in Fortinet FortiMail, the vendor's secure email gateway product. Fortinet assigns the flaw a CVSS score of 9.8, and its FG-IR-26-175 advisory states that the issue has been reported as exploited in the wild. On October 1, 2026, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The combination matters more than either signal alone. A remote, unauthenticated file-write primitive inside an email gateway is already a serious exposure. Active exploitation and a KEV listing move it into the category of issues that administrators are expected to address immediately rather than on a routine patch cycle.

Mechanism and exploitation conditions

Fortinet describes the vulnerability as a path traversal (CWE-22) combined with improper neutralization of a NULL byte or NULL character (CWE-158). An attacker sends crafted HTTP or HTTPS requests to the affected appliance. The traversal component allows files to be written outside the intended directory, while the NULL byte handling weakness undermines the validation that would normally constrain where a request can place content.

Because the flaw is reachable through the web-facing management interface of FortiMail, the attacker does not need valid credentials. Reporting cited by securityonline.info places the defect in the GUI's Identity Based Encryption (IBE) component. Fortinet characterizes the resulting impact as the ability to execute unauthorized code or commands, which is consistent with arbitrary file write reaching an executable path or a configuration file that the appliance later processes.

Impact

A successful exploit gives an unauthenticated attacker the ability to write files on the underlying system. Depending on what can be overwritten, that capability can escalate toward code execution, persistent tampering with the gateway, or disruption of mail processing. FortiMail sits at the boundary between the internet and an organization's mail infrastructure, so a compromised gateway can expose message traffic and provide a foothold from which an attacker moves further into the network.

The operational consequences extend beyond the appliance itself. Mail security gateways typically hold credentials, routing rules and trust relationships with downstream systems. An attacker who controls one can intercept, alter or suppress messages, and can use the position to reach internal hosts that would never accept a direct connection from outside.

Affected products and scope

Fortinet lists the following FortiMail versions as affected:

  • FortiMail 8.0.0
  • FortiMail 7.6.0 through 7.6.5
  • FortiMail 7.4.0 through 7.4.6
  • FortiMail 7.2.0 through 7.2.9
  • FortiMail 7.0.0 through 7.0.9

The vendor identifies the IBE component as the location of the defect, and the workaround of disabling IBE implies that deployments not using that feature are exposed only in the sense that the code path still exists on the appliance. Administrators should treat any internet-reachable management interface as the relevant exposure boundary.

Exposure context

A ZoomEye query for the product fingerprint app="FortiMail" returned 3911 matching instances at the time of writing. A separate query using vul.cve="CVE-2026-104286" returned zero indexed assets. The product query describes assets that ZoomEye recognizes as FortiMail deployments; it does not prove that any individual instance is vulnerable or unpatched. The gap between the two counts is a reminder that CVE-level indexing lags behind product identification, and that exposure estimates built on a product fingerprint should be read as an upper bound rather than a confirmation.

Remediation and mitigations

Fortinet's advisory directs customers to apply the available workaround, which reporting indicates means disabling IBE or restricting management access to trusted internal networks. Both steps reduce reachability of the vulnerable component without removing it. Teams that disable IBE should confirm that no mail flow depends on that feature before making the change.

Fixed builds are expected in FortiMail 8.0.2, 7.6.7 and 7.4.9. Users on the 7.2 branch are advised to move to 7.4 or later. No fix is named for the 7.0 branch, so organizations still running it should plan a migration rather than wait for a patch.

Because exploitation is confirmed, remediation should be paired with a compromise assessment. Practical checks include reviewing the appliance for modified binaries and unexpected library preloads, looking for outbound connections to unknown hosts, and comparing current configuration against a known-good baseline. Federal agencies operating under BOD 26-04 faced an October 4, 2026 deadline for action, and other organizations have no reason to move more slowly.

References

Top comments (0)