CVE-2026-104286: Fortinet FortiMail Path Traversal RCE (KEV)

CVE-2026-104286 is a path traversal flaw in the IBE (Identity-Based Encryption) webmail component of Fortinet FortiMail that lets a remote, unauthenticated attacker write arbitrary files on the underlying system via a crafted HTTP or HTTPS request, and Fortinet confirms it has already been exploited in the wild.

CVE-2026-104286 is an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) combined with an Improper Neutralization of NULL Byte or NULL Character (CWE-158) in Fortinet FortiMail. A remote, unauthenticated attacker can send a crafted HTTP or HTTPS request that escapes the intended directory and writes an arbitrary file to the underlying filesystem (NVD).

NVD's vulnStatus for this record is Analyzed, but NVD has not published its own independent Primary CVSS score; the only CVSS v3.1 metric on record is the CNA-submitted Secondary rating of 9.8 (critical) from Fortinet's own PSIRT, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no authentication or user interaction required, with high impact to confidentiality, integrity and availability. So the 9.8 shown here is the Fortinet CNA's Secondary score, not an NVD-confirmed Primary score (NVD).

Fortinet's PSIRT advisory FG-IR-26-175 states plainly: "This has been reported to be exploited in the wild, customers are urged to apply the workaround below." The advisory lists affected builds (FortiMail 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, 8.0.0-8.0.1), confirms FortiMail Cloud was already remediated by Fortinet on 2026-10-05, and gives indicators of compromise, including two attacker IP addresses and FortiMail log signatures of the exploitation chain. The recommended workaround for appliances pending upgrade is to disable the IBE feature (config system encryption ibe / set status disable), restrict webmail access to trusted networks, or block POST requests to /ibe containing ../ at a web application firewall (Fortinet PSIRT Advisory FG-IR-26-175).

CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-01, with a required-action due date of 2026-10-04 and a forensic-triage requirement under BOD 26-04, though the catalog does not record known ransomware campaign use (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.0457 (91.572th percentile) (FIRST EPSS).

Because active exploitation is already confirmed, any FortiMail deployment on an affected build should disable IBE or restrict webmail access immediately, check logs against Fortinet's published indicators of compromise, and upgrade to the fixed release as soon as possible.

• Unauthenticated, remote path traversal and NULL-byte neutralization flaw in FortiMail allows arbitrary file writes via crafted HTTP/HTTPS requests to the IBE webmail component. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — the Fortinet CNA's Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Confirmed exploited in the wild; affected builds are FortiMail 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, 8.0.0-8.0.1; FortiMail Cloud already remediated 2026-10-05; workaround is disabling the IBE feature, restricting webmail access, or WAF-blocking '../' in POST requests to /ibe; advisory includes indicators of compromise. — Fortinet PSIRT Advisory FG-IR-26-175
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-01, required-action due date 2026-10-04, forensic triage required under BOD 26-04. — CISA KEV
• EPSS score is 0.0457 (91.572th percentile) as of 2026-10-27. — FIRST EPSS