CVE-2026-104286KEV · OVERDUECWE-22path-traversal

Fortinet FortiMail Path Traversal Vulnerability

Critical · published October 2, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 82.4th percentile for exploit probability.

20
days past CISA
deadline
CVSS v3.1
9.8
EPSS
2%
Percentile
82.4
In the wild
Confirmed
What it is

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02201 · 82.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-02T00:17Z
KEV added
2026-10-01 · due 2026-10-04
Affected products (3)
ProductVersionsFixed in
fortinet/fortimail≥ 7.2.0, ≤ 7.4.8—
fortinet/fortimail≥ 7.6.0, ≤ 7.6.6—
fortinet/fortimail≥ 8.0.0, ≤ 8.0.1—
References (2)
https://fortiguard.fortinet.com/psirt/FG-IR-26-175 · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 2%
    epss
  • 01 OCT 19:17Z
    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…
    cvelistv5