Summary
- CVE-2026-104286 affects several supported FortiMail branches and is known to have been exploited.
- The vulnerability is a path traversal weakness affecting an internet facing email security product.
- CISA has added the flaw to its Known Exploited Vulnerabilities catalogue.
An exploited vulnerability affecting Fortinet FortiMail can allow unauthenticated attackers to write files outside their intended location, placing internet facing email security infrastructure under active attack.
CVE-2026-104286 is classified as a path traversal vulnerability and affects several FortiMail release branches, with vulnerable versions listed across the 7.2, 7.4, 7.6, and 8.0 product lines.
CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 1 October, moving remediation decisions beyond a theoretical severity assessment because attacker use has already been observed.
Since FortiMail appliances process external email traffic and commonly sit close to the boundary of enterprise networks, compromise affects infrastructure that organisations rely on to inspect and control communications arriving from outside.
Exploitation changes the response window
Path traversal weaknesses allow crafted input to reach file locations outside the directory an application intended to expose, while the ultimate effect depends on which locations can be written and how the underlying system handles the resulting files.
Arbitrary file write capabilities can support more serious compromise when attackers can place content in locations that influence application or operating system behaviour, although the public record does not establish that every observed FortiMail attack progressed through the same subsequent steps.
Because exploitation was already occurring when defenders learned of the vulnerability, organisations were dealing with a zero day rather than a flaw disclosed through a conventional sequence of advisory, patching, and later attacker adoption.
Email gateways can also maintain configuration information, routing details, administrative accounts, and integrations with wider enterprise services, which gives attackers reasons to target the appliance beyond the messages passing through it.
Public information has not established a victim count or identified the operators behind the exploitation, leaving the confirmed position centred on the vulnerable FortiMail releases and evidence that attackers have already used the flaw.
