CVE-2026-104286 · High · CISA KEV

FortiMail Path Traversal: Unauthenticated File Write via Crafted HTTP/S Requests

Threat Engine Auto-Feed · data current as of 2026-10-02

CVE-2026-104286 in Fortinet FortiMail allows an unauthenticated attacker to write arbitrary files to the system. This is due to a path traversal and improper NULL byte neutralization vulnerability. It is listed in CISA KEV, indicating active exploitation in the wild.

  • CVSS:
  • EPSS percentile: 0.77459
  • Exploitation pressure: 71/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 77th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves a 'path traversal' and 'improper neutralization of NULL byte or NULL character'. Path traversal means an attacker can manipulate file paths to access or write to directories outside of the intended scope. Improper neutralization of NULL bytes allows an attacker to bypass security checks by inserting a null character into a string, which can truncate the string and change its interpretation by the system.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Fortinet FortiMail for email security, particularly those in Financial Services and Technology sectors, due to confirmed adversary targeting.
  • Enterprises with critical data processed or stored on email gateway systems.

Misconfigurations that escalate it

  • Lack of robust input validation on HTTP/HTTPS request handling.
  • Insufficient file system access controls that could limit the impact of arbitrary file writes.

High-impact scenarios

  • An unauthenticated attacker writing malicious files to the underlying system, potentially leading to remote code execution or system compromise.
  • Data integrity loss due to unauthorized file modification or creation.
  • Disruption of email services or the entire FortiMail appliance.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor FortiMail logs for unusual file write activities or unexpected HTTP/HTTPS request patterns.
  • Implement network intrusion detection systems (NIDS) to flag crafted HTTP/HTTPS requests targeting FortiMail.
  • Regularly audit system files on FortiMail for unauthorized changes or new files.

Contain

  • Isolate affected FortiMail instances from the network if compromise is suspected.
  • Block suspicious IP addresses or request patterns at the network perimeter.

Patch

  • Apply the latest security updates and patches from Fortinet for FortiMail immediately.

Frontier verdict — High

High priority due to active exploitation (CISA KEV) and potential for unauthenticated arbitrary file write on FortiMail.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.