Search/CVE-2026-104286
● CVE — Critical

CVE-2026-104286

VendorfortinetProductfortimailDiscoveredOct 1, 2026UpdatedOct 7, 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
2.20%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
9
sources referencing this CVE
Related IOCs
9
seen in the same coverage
EPSS Trend
Oct 3, 2026 → Oct 4, 2026
▲ 0.42pp
1.78% → 2.20% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
13 relationships
Timeline
disclosure → media coverage
Oct 1, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 7, 2026
Oct 1, 2026
bleepingcomputer.com reports: Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
Oct 2, 2026
thehackernews.com reports: Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Oct 2, 2026
acn.gov.it reports: Fortinet: rilevato sfruttamento in rete della CVE-2026-104286 relativa a FortiMail
Oct 2, 2026
advisories.ncsc.nl reports: NCSC-2026-0398 [1.00] [M/H] Kwetsbaarheid verholpen in Fortinet FortiMail
Oct 2, 2026
securityweek.com reports: Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
Oct 2, 2026
helpnetsecurity.com reports: Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)
Oct 2, 2026
theregister.com reports: Fortinet sounds the alarm over actively exploited FortiMail zero-day
Oct 4, 2026
helpnetsecurity.com reports: Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited
Oct 5, 2026
thehackernews.com reports: ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Public PoC (3)
github.com/ShadowForge-Cyber/CVE-2026-104286-POCgithub.com/techupdate24/fortimail-zero-day-cve-2026-104286github.com/kh20134/fortimail-cve-2026-104286-response
Unverified third-party code — review before executing.