CVE-2026-104286

Executive Summary

CVE-2026-104286 is a critical unauthenticated path traversal vulnerability (CWE-22) in Fortinet FortiMail that allows a remote attacker to write arbitrary files to the underlying operating system via crafted HTTP or HTTPS requests. All FortiMail deployments running versions 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, or 8.0.0–8.0.1 are affected. With a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation requires no authentication, no user interaction, and no special conditions, and carries full impact to confidentiality, integrity, and availability. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-10-04, indicating confirmed exploitation in the wild.

Technical Analysis

CVE-2026-104286 is classified as an improper limitation of a pathname to a restricted directory — a path traversal vulnerability (CWE-22). The flaw resides in the HTTP/HTTPS request handling surface of FortiMail, Fortinet's secure email gateway appliance. According to the NVD description, the vulnerability "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests."

The defining characteristics of the vulnerability class are as follows:

• Attack vector: Network-reachable, unauthenticated. The CVSS vector AV:N/PR:N confirms no prior credentials or session are required. The attacker interacts directly with the exposed HTTP/HTTPS service.
• Mechanism: User-supplied pathname components within an HTTP or HTTPS request are not adequately constrained to an intended restricted directory. Because the application fails to properly sanitize or confine the resulting file path, an attacker can supply traversal sequences that redirect a write operation to a location outside the intended directory. The NVD description explicitly confirms the primitive is an arbitrary file write, not merely file read.
• Scope: CVSS scope is Unchanged (S:U), meaning the impact remains within the security authority of the vulnerable FortiMail component.
• Impact triad: All three CIA subscores are High. Arbitrary file write on an appliance of this class typically enables integrity compromise (planting or modifying files), confidentiality compromise (influencing what the system reads or serves), and availability compromise (overwriting or corrupting critical files). The CVSS vector does not by itself prove remote code execution; however, arbitrary write primitives against an internet-facing appliance commonly serve as a stepping stone toward code execution or configuration manipulation.
• Preconditions: The only stated precondition is network reachability to the FortiMail HTTP/HTTPS management or service interface. No authentication is required.

Insufficient technical detail is available in the provided NVD description to identify specific request parameters, endpoint paths, uploaded field names, or the precise filesystem location targeted by the traversal. The description does not disclose whether the write primitive targets web-accessible directories, configuration stores, or other system locations. Analysts should not assume specific filenames, parameters, or endpoints beyond what is documented.

The breadth of affected branches — 7.2.x, 7.4.x, 7.6.x, and 8.0.x — spanning many minor releases indicates a long-lived code path rather than a recently introduced regression, which raises the likelihood that reverse engineering of the patched version (once available) will quickly yield a precise exploitation recipe.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code has been observed for CVE-2026-104286 as of this report. The following attack chain is therefore inferred strictly from the vulnerability class (CWE-22, arbitrary file write) and the NVD description, and does not assert undocumented implementation specifics. No specific function names, endpoints, parameters, or file paths are invented here.

1. Reconnaissance / target identification. An attacker identifies internet-facing FortiMail instances. This is achievable through internet-wide scanning using Shodan/Censys queries targeting FortiMail HTTP titles and certificates, or through targeted scanning of known enterprise mail-gateway address ranges. Because the vulnerability is unauthenticated, the attacker does not need to obtain credentials or a foothold — only network access to the exposed HTTP/HTTPS service.

2. Triggering the flaw class. The attacker sends a crafted HTTP or HTTPS request in which a pathname component is manipulated with directory-traversal sequences so that the resulting path escapes the intended restricted directory. Per the NVD description, this request is unauthenticated and results in a file-write operation rather than a read. The precise request structure, parameter, and traversal encoding are not documented in the available data and must not be assumed.

3. Payload / execution method (vulnerability-class level). At the class level, the attacker uses the uncontrolled pathname to direct the write to a location of their choosing outside the restricted directory. The content written is attacker-controlled. Whether this content can be positioned to achieve code execution, configuration modification, or persistence depends on where write access lands and is not established by the NVD description. No public PoC exists; this step is described at the vulnerability-class level only.

4. Post-exploitation impact. Given the High integrity and availability subscores, the realistic outcomes are corruption or replacement of system files, potential manipulation of application behavior, denial of service via overwriting critical files, and — depending on reachable write locations — a pathway toward further compromise. Given CISA KEV listing, exploitation in the wild is confirmed, which implies attackers have found a practical use for the write primitive even without a public PoC.

Absent documented detail, defenders should treat every unauthenticated write to the FortiMail filesystem as a potential precursor to full appliance compromise.

Impact Assessment

• Confidentiality (High): Arbitrary write primitives on an appliance frequently enable indirect disclosure — e.g., by influencing files the application later serves or reads. The CVSS subscore is High.
• Integrity (High): This is the most directly implicated dimension. An attacker who can write files of their choosing can alter application behavior, plant content, or modify data the system relies upon.
• Availability (High): Overwriting or corrupting critical files can render the mail gateway inoperable, disrupting all inbound/outbound mail processing for the organization.

Affected systems: Fortinet FortiMail secure email gateways across versions 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1. FortiMail is commonly deployed at the network perimeter as the primary mail security control, making it both highly exposed and highly business-critical.

Blast radius: Because FortiMail is a perimeter email gateway, compromise can affect the entire organization's email flow. A mail gateway that is subverted can serve as a trusted conduit for further attacks (for example, manipulating mail handling or trust relationships), and its write access to the underlying system makes it a valuable pivot point. The unauthenticated nature of the flaw (PR:N) means any internet-reachable instance is potentially at risk without any credential barrier.

Exploitation status: CISA KEV listing confirms exploitation in the wild, elevating this from theoretical risk to active threat. Organizations should treat perimeter FortiMail appliances as actively targeted.

Detection Guidance

Sigma Rule

title: FortiMail Path Traversal Arbitrary File Write Attempt (CVE-2026-104286)
id: 7c9a1f42-0e2b-4d3a-9b6e-cve202610428
status: experimental
description: Detects HTTP/HTTPS requests containing directory traversal sequences targeting FortiMail, indicative of CVE-2026-104286 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104286
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: fortinet
  service: fortimail
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - PUT
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%2F'
      - '%2e%2e/'
      - '%2e%2e%2f'
      - '....//'
      - '..\\'
      - '%252e%252e%252f'
  condition: selection_method and selection_traversal
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate applications passing encoded dot-segments in non-file contexts
level: high
tags:
  - attack.t1190
  - cve.2026.104286

YARA Rule

rule CVE_2026_104286_FortiMail_PathTraversal
{
    meta:
        description = "Detects path traversal exploitation attempts against FortiMail (CVE-2026-104286) in HTTP request logs or captured traffic"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104286"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $enc1 = "..%2f" ascii nocase
        $enc2 = "%2e%2e%2f" ascii nocase
        $enc3 = "%252e%252e%252f" ascii nocase
        $http1 = "POST /" ascii
        $http2 = "PUT /" ascii
        $fortimail = "FortiMail" ascii wide nocase

    condition:
        uint16(0) == 0x4854 or $fortimail or
        (
            any of ($traversal*) and any of ($http*)
        ) or
        any of ($enc*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104286 Fortinet FortiMail Path Traversal Arbitrary File Write Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%252e%252e%252f|\.\.%2f)/i"; classtype:web-application-attack; reference:cve,2026-104286; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104286; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026104286; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and http.request.method in ("POST", "PUT")]
  [network where network.protocol == "http" and
     (url.query : "*../*" or
      url.query : "*..%2f*" or
      url.query : "*%2e%2e%2f*" or
      url.query : "*%252e%252e%252f*" or
      url.full : "*..\\*") and
     destination.port in (80, 443, 8080, 8443)]

Splunk SPL Query

index=web OR index=proxy
| eval uri=lower(coalesce(uri, url, cs_uri_query, request_url))
| where (match(uri, "\.\./") OR match(uri, "\.\.%2f")
        OR match(uri, "%2e%2e%2f") OR match(uri, "%252e%252e%252f")
        OR match(uri, "\.\.\\\\"))
| where IN(method, "GET", "POST", "PUT")
| stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods values(status) as status_codes by src_ip, dest_ip, uri
| sort - count

Wazuh OSSEC Rule

<group name="fortimail,web,attack,">
  <rule id="2026104" level="12">
    <decoded_as>json</decoded_as>
    <field name="url|query">\.\./|\.\.%2f|%2e%2e%2f|%252e%252e%252f</field>
    <description>CVE-2026-104286: FortiMail path traversal arbitrary file write attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104286,</group>
  </rule>
  <rule id="2026105" level="15">
    <if_sid>2026104</if_sid>
    <field name="status">2\d\d</field>
    <description>CVE-2026-104286: FortiMail path traversal attempt returned success status - possible successful exploitation</description>
    <group>cve_2026_104286,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version advisory content was available from the tracked sources at the time of writing. Given CISA KEV listing, treat this as an actively exploited vulnerability requiring immediate compensating action.

1) Immediate mitigations (no patch available):

• Remove FortiMail HTTP/HTTPS management and service interfaces from direct internet exposure. Restrict access to a trusted management network or VPN, enforced by firewall/security-group rules.
• Where internet exposure is operationally unavoidable, front the appliance with a reverse proxy or WAF that normalizes and rejects requests containing path traversal sequences.
• Apply strict allowlisting on inbound management access (source IP allowlist) and disable any unused HTTP/HTTPS services on the appliance.
• Monitor and alert on all traversal-sequence requests to the appliance (see Detection Guidance).
• Isolate the FortiMail management plane from the mail data plane where architecture permits.

2) Patch/upgrade steps:

• Monitor Fortinet's PSIRT advisories (fortiguard.fortinet.com/psirt) and the FortiMail release notes for an official fixed build covering the 7.2.x, 7.4.x, 7.6.x, and 8.0.x branches.
• Once an official fix is released, prioritize upgrade of all internet-reachable instances first, validate the fixed build on a non-production instance, then roll out across the fleet.
• Because patch confidence is currently 0/4, do NOT assume any available build contains the fix. Verify against the vendor advisory before relying on it.

3) Long-term hardening:

• Adopt a hardening baseline that removes internet-facing management interfaces from perimeter appliances by default.
• Deploy egress and ingress filtering to constrain what a compromised appliance could reach.
• Maintain continuous vulnerability scanning of perimeter systems and ingest CISA KEV into patch prioritization.
• Enable comprehensive logging (HTTP request logs, file integrity monitoring on the underlying system) and forward to a SIEM with the detection rules above.
• Conduct file integrity monitoring to detect unauthorized file writes to the appliance filesystem.
• Practice least-privilege and network segmentation so that a single appliance write primitive cannot cascade into enterprise-wide impact.

References

• NVD — CVE-2026-104286: https://nvd.nist.gov/vuln/detail/CVE-2026-104286
• CISA Known Exploited Vulnerabilities Catalog — "Fortinet FortiMail Path Traversal Vulnerability," remediation due 2026-10-04: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Fortinet PSIRT Advisories (monitor for the fixed build): https://www.fortiguard.com/psirt
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploitation status: CISA KEV listing confirms exploitation in the wild. No public PoC, Nuclei template, or published exploit code was identified in the tracked sources at the time of this report. Specific threat-actor attribution is not available from the provided data and is not asserted here.