EXPOSURES › CVE-2026-104286
CVE-2026-104286
HIGH ⌖ ON CISA KEV · EXPLOITEDFortinet FortiMail suffered a path traversal vulnerability allowing unauthenticated attackers to write arbitrary files on the system.
An unauthenticated attacker could exploit a path traversal flaw in Fortinet FortiMail to write arbitrary files via crafted HTTP/HTTPS requests, potentially leading to system compromise. DIB organizations must ensure FortiMail is patched immediately, as this vulnerability is actively exploited in the wild and represents a significant compliance risk under CMMC/NIST 800-171 for protecting information systems.
Shame score — The vulnerability is actively exploited in the wild (KEV), allowing unauthenticated attackers to write arbitrary files, indicating a severe and avoidable security failure.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.