CVE-2026-104286 is a critical path traversal vulnerability (CWE-22, with NULL byte handling, CWE-158) in Fortinet FortiMail. An unauthenticated remote attacker can send crafted requests to the management or webmail (Identity-Based Encryption, IBE) interface to write arbitrary files to the system, which can lead to remote code execution. CVSS score: 9.8 (Critical). Fortinet tracks it as FG-IR-26-175.

The following FortiMail versions are affected:

FortiMail 8.0.0 through 8.0.1 – (Affected)
FortiMail 7.6.0 through 7.6.6 – (Affected)
FortiMail 7.4.0 through 7.4.8 – (Affected)
FortiMail 7.2.0 through 7.2.9 – (Affected)

Not affected / patched version:

Fixed releases announced by Fortinet: FortiMail 8.0.2, 7.6.7 and 7.4.9, once available – (Not affected)
FortiMail 7.2 has no planned fix; migrate to 7.4 or later

Successful exploitation may allow attackers to:

• Write arbitrary files to the mail gateway without authentication
• Execute arbitrary code on the FortiMail appliance, leading to full compromise of the device
• Access, alter or redirect email traffic, and use the appliance as a foothold into the internal network

CERTVU recommends the following:

1. Apply the Fixed Release as Soon as Available

   Upgrade to FortiMail 8.0.2, 7.6.7 or 7.4.9 as applicable, and migrate FortiMail 7.2 to 7.4 or later. Check Fortinet advisory FG-IR-26-175 for the current availability.

2. Apply Workarounds Until Patched

3. Add Compensating Controls

4. Hunt for Compromise