This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet warns of an actively exploited vulnerability in FortiMail

Fortinet warns of an actively exploited vulnerability [1] in FortiMail [2]. The fix will be included in versions 7.4.9, 7.6.7 and 8.0.2, which are not yet available at the time this report was published [2].

FortiMail - writing of arbitrary files (CVE-2026-104286)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can write arbitrary files to the device's system without authorization by sending specially crafted HTTP/HTTPS requests. Since an immediate update to a fixed version is not yet possible, it is recommended to temporarily mitigate the risk by disabling support for the Identity Based Encryption (IBE) feature or by blocking access to the FortiMail management interface from the internet or restricting it to trusted private networks only. Detailed information about the vulnerability, including IoCs, can be found at [2].

The vulnerability is present in product:

  • FortiMail;>=7.2.0,<=7.2.9;>=7.4.0,<=7.4.8;>=7.6.0,<=7.6.6;>=8.0.0,<=8.0.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C

More information:

  • CVE-2026-104286 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
  • CWE-158: Improper Neutralization of Null Byte or NUL Character at cwe.mitre.org

The vulnerability was publicly disclosed 1. 10. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 2. 10. 2026.

CESNET, z.s.p.o. Logo