# Fortinet FortiMail Path Traversal (CVE-2026-104286) Under Active Attack

> CISA confirms active exploitation of CVE-2026-104286, an unauthenticated path traversal vulnerability in Fortinet FortiMail, allowing arbitrary file writes.

- Published: 2026-10-01T20:53:55.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: Fortinet, Path Traversal, CISA KEV, CVE-2026-104286, FortiMail
- CVEs: CVE-2026-104286
- Author: Runtime Rebel Intel
- Primary source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286
- Canonical: https://runtimerebel.com/blog/fortinet-fortimail-path-traversal-cve-2026-104286-under-active-attack

## Key points

- Unauthenticated attackers are actively exploiting FortiMail, enabling arbitrary file writes on affected systems.
- Fortinet FortiMail instances are vulnerable to path traversal (CVE-2026-104286) and null byte issues.
- Apply vendor-provided mitigations or patches immediately to secure FortiMail deployments.

The [CISA](/glossary#cybersecurity-and-infrastructure-security-agency-cisa) Known Exploited Vulnerabilities ([KEV](/glossary#kev)) catalog has added [CVE-2026-104286](https://nvd.nist.gov/vuln/detail/CVE-2026-104286), identifying a critical path traversal [vulnerability](/glossary#vulnerability) in Fortinet FortiMail under active exploitation. This flaw allows unauthenticated attackers to write arbitrary files to the underlying system through crafted HTTP or HTTPS requests, posing a significant threat to organizations utilizing this email security gateway. The immediate addition to the KEV catalog, coupled with a federal remediation due date of 2026-10-04, underscores the urgency for all FortiMail administrators to apply necessary mitigations without delay.

## [CVE](/glossary#cve)-2026-104286: Technical Details and Active Exploitation

### Understanding Fortinet FortiMail Path Traversal Vulnerability

The vulnerability, tracked as [CVE-2026-104286](https://nvd.nist.gov/vuln/detail/CVE-2026-104286), stems from a combination of a path traversal flaw (categorized as [CWE-22](https://cwe.mitre.org/data/definitions/22.html)) and an improper neutralization of NULL byte or NULL character ([CWE-158](https://cwe.mitre.org/data/definitions/158.html)). This particular combination enables an attacker to bypass directory restrictions and place files in unintended locations on the system. Crucially, the exploitation of this vulnerability does not require authentication, making it accessible to any malicious actor capable of sending specially crafted HTTP or HTTPS requests to a vulnerable FortiMail instance.

The ability for an unauthenticated attacker to write arbitrary files on the system is a severe security flaw. In most cases, this capability can be leveraged to achieve remote code execution ([RCE](/glossary#rce)), allowing the attacker to completely compromise the underlying operating system of the FortiMail appliance. This level of access could lead to [data exfiltration](/glossary#data-exfiltration), deployment of further [malware](/glossary#malware), or disruption of email services, jeopardizing organizational communications and data integrity. The presence of this vulnerability in the CISA KEV catalog confirms that threat actors are actively exploiting it in the wild, requiring immediate attention. Security teams researching "detect CVE-2026-104286 FortiMail exploitation" should focus on network traffic anomalies and file system changes.

## Impact and Who is Affected

Any organization deploying Fortinet FortiMail appliances is potentially at risk, especially those with internet-exposed instances. The unauthenticated nature of the [exploit](/glossary#exploit) means that external attackers can target these systems without prior credentials or access. Successful exploitation could lead to:

*   **System Compromise:** Full control over the FortiMail appliance, potentially enabling remote code execution.
*   **Data Exfiltration:** Access to sensitive email data or configuration files stored on the device.
*   **[Lateral Movement](/glossary#lateral-movement):** The compromised FortiMail appliance could serve as a beachhead for attackers to pivot further into the internal network.
*   **Service Disruption:** Tampering with or disabling email gateway functionalities.

Given its placement in CISA's KEV catalog, federal agencies are mandated to remediate this vulnerability by the specified due date. However, this urgency extends to all public and private sector entities, as the confirmed active exploitation signifies a clear and present danger to affected systems globally.

## Actionable Recommendations: Mitigating FortiMail Path Traversal

Organizations must act swiftly to address the Fortinet FortiMail path traversal vulnerability. The primary recommendation, according to [CISA's KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286), is to apply mitigations in accordance with vendor instructions.

### Fortinet FortiMail Path Traversal Mitigation Steps

*   **Immediate Patching:** Prioritize and apply all available security updates and patches from Fortinet for your FortiMail deployments. Ensure compliance with CISA’s BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance.
*   **Vulnerability Assessment:** Conduct an immediate scan of your network to identify all FortiMail instances and verify their [patch](/glossary#patch) status.
*   **[Network Segmentation](/glossary#network-segmentation):** Isolate FortiMail appliances on a dedicated network segment, limiting their exposure to the broader internal network and the internet where possible.
*   **Monitoring and Detection:** Implement enhanced monitoring for suspicious activity originating from or directed at FortiMail devices. This includes reviewing logs for unusual file writes, unexpected process execution, or anomalous network connections. Adherence to CISA’s "Forensics Triage Requirements" is advised for potential compromise indicators.
*   **Discontinue Use (If Unmitigatable):** If vendor-provided mitigations are unavailable or cannot be immediately applied, CISA's guidance suggests discontinuing the use of the product until a secure state can be achieved. This applies especially to internet-facing instances.

Administrators should also evaluate each asset's internet exposure and ensure adherence to BOD 26-04 patching guidelines for their specific environment, including any cloud services where FortiMail may be deployed. Proactive measures are essential to prevent adversaries from leveraging this actively exploited flaw.

**Related:** [CVE-2026-66384: JFrog Artifactory Path Traversal Exploit](/blog/cve-2026-66384-jfrog-artifactory-path-traversal-exploit), [CVE-2025-68686: Fortinet FortiOS Patch Bypass for Post-Exploit Persistence](/blog/cve-2025-68686-fortinet-fortios-patch-bypass-for-post-exploit-persistence)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/fortinet-fortimail-path-traversal-cve-2026-104286-under-active-attack