FortiMail path traversal lets an unauthenticated attacker write files
Fortinet published CVE-2026-104286 on October 1, 2026. An unauthenticated attacker can write arbitrary files on affected FortiMail systems through crafted web requests, and Fortinet says the bug has been exploited.
What was reported
Fortinet's advisory FG-IR-26-175, first published October 1, 2026 and updated October 7, describes CVE-2026-104286 as a path-traversal bug that also mishandles null bytes. An unauthenticated attacker can write arbitrary files via crafted HTTP or HTTPS requests. Fortinet marks it known exploited, critical, CVSS 9.8, with impact "execute unauthorized code or commands."
Affected ranges in the advisory are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fortinet says FortiMail Cloud was moved to 7.6.7 or 8.0.2 on October 5, 2026.
A mail gateway is a public service by design. The management and webmail paths in front of it are not, and that is the part this bug uses.
How to prevent it
Upgrade self-managed FortiMail to a fixed release: 8.0.2 or above, 7.6.7 or above, or 7.4.9 or above. Fortinet says the 7.2 branch has no fix and should move to 7.4 or above. Until you patch, turn the IBE service off or keep the webmail interface off the public internet. Fortinet says FortiMail Cloud was updated on October 5, 2026, and those customers do not need to act.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.