Zero Radar
← feed
CriticalVulnerabilityCVE-2026-104286updated 28 Oct 2026, 14:25 UTC

FortiMail lets unauthenticated attackers write arbitrary files via web requests

Attackers can send specially crafted web requests to FortiMail email security appliances and write files anywhere on the system, without logging in. This can let them take control of the device.

Exploited (CISA KEV, NVD)Official, 3 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 1 Oct 2026,
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login or account needed
  2. 2Crafted HTTP requestSent to the FortiMail web interface
  3. 3Path traversal bypassNULL byte tricks path checks
  4. 4Arbitrary file writtenFiles placed anywhere on the system
  5. ResultAttacker gains control of the appliance

What happened

A path traversal flaw combined with improper handling of NULL bytes in Fortinet FortiMail's HTTP/HTTPS interface allows unauthenticated arbitrary file writes on the underlying system.

Why it is dangerous: Successful exploitation gives an attacker a foothold on a mail security gateway that sits in front of organizations' email, putting email traffic and internal systems at risk. CISA lists this vulnerability as known to be exploited.

Are you affected?

You are affected if you run FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or 7.2.0 through 7.2.9, or the older 7.0 branch as listed by NVD.

FortiMail 8.0.0 to 8.0.1; 7.6.0 to 7.6.6; 7.4.0 to 7.4.8; 7.2.0 to 7.2.9; 7.0 (all versions per NVD)

What to do

  1. Check FortiMail version and identify any devices running affected releases
  2. Apply the fixed firmware from Fortinet advisory FG-IR-26-175 as soon as available
  3. If patching is not immediately possible, follow the vendor mitigation instructions and restrict internet exposure of the management interface
  4. Review the device for signs of compromise following CISA forensics triage guidance

Timeline

  1. 1 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 1 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 28 Oct 2026, 14:25 UTC
    NVD reported on it · NVD

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-104286 · GHSA-6gxc-3vv7-7w24
CVSS
9.8 / 10
EPSS
4.6% chance of exploitation within 30 days
Disclosed
1 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 14:25 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

FortiMail lets unauthenticated attackers write arbitrary files via web requests · Zero Radar