FortiMail is Fortinet’s email-security platform: a gateway that receives, scans and relays mail before it reaches a company’s mail system. It can sit in front of on-premises servers, Microsoft 365, Google Workspace or hybrid mail, and comes as an appliance, virtual deployment, hosted offering and SaaS. That puts its management plane close to a system organisations trust to inspect both inbound and outbound email.
CVE-2026-104286 is a path traversal bug in that management interface, paired with improper handling of NULL bytes or characters. In plain terms, a crafted HTTP or HTTPS request can manipulate a filesystem path so that FortiMail writes a file somewhere it was not meant to write it. The attacker does not need an account: successful exploitation gives an unauthenticated remote party the ability to write arbitrary files on the underlying system.
An exposed management interface becomes the entry point
This is not a mail-message parsing flaw; the relevant route is the appliance’s web management surface. That distinction matters operationally. An organisation can be filtering email correctly yet still leave the administrative interface reachable from the internet, giving an outsider a direct path to the vulnerable component.
The affected ranges reported in the advisory are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Published data conflicts over the 7.0 branch: the advisory reporting does not list it, while a structured record does. Its status cannot be confirmed from the published material.
The usual exposure is broad rather than tied to one vertical. Any organisation running FortiMail as an email gateway may be affected, while managed service providers, managed security providers and telecommunications providers merit particular attention because multi-tenant deployments can protect customer mail environments. Internet-facing administration is the urgent risk multiplier.
Exploitation is confirmed, but public code has not surfaced
Fortinet reported active exploitation and published compromise indicators. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on October 1, 2026, with an October 4 federal remediation deadline and a forensic-triage requirement under BOD 26-04. Ransomware-campaign use is listed as unknown; there is also no public attribution to a named group.
No public proof of concept or exploit code surfaced in searches of GitHub, Exploit-DB, Metasploit and Nuclei references on October 1. That is not evidence that private tooling does not exist, and it should not dilute the confirmed exploitation signal. Reported compromise artifacts include altered libraries, executables, HTTP configuration and loader-preload files, so responders should investigate for changes beyond the web interface itself.
Contain first, then move to the fixed train
Fortinet identified 8.0.2, 7.6.7 and 7.4.9 as intended fixed releases; 7.2 users are directed to migrate to a fixed 7.4-or-later release. But reporting available on October 1 described those releases as upcoming, and no release notes confirming their availability were found. Teams should verify availability with the vendor rather than assume a named target version can already be installed.
Until firmware is available, disable IBE support or remove internet access to the management interface and limit it to trusted private networks. Inventory every FortiMail deployment, preserve logs and system evidence before cleanup, and hunt using the vendor’s indicators. Finally, SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs—use that visibility to catch exposed appliances and track the eventual fixed release.
