FortiMail path traversal lets an unauthenticated attacker write files
Fortinet published CVE-2026-104286 on October 1, 2026. An unauthenticated attacker can write arbitrary files on affected FortiMail systems through crafted web requests, and Fortinet says the bug has been exploited.