CVE-2026-104286: Fortinet FortiMail Management Interfaces Actively Exploited

CVE-2026-104286 (CVSS 9.8, EPSS ≥ 82nd pctl) is a critical path traversal [CWE-22] and NULL-byte handling flaw [CWE-158] affecting Fortinet FortiMail. Exploitation can be achieved via HTTP/HTTPS request to the FortiMail web interface. The CVE was both published and added to CISA’s KEV list on October 1st, 2026. Successful exploitation allows writing arbitrary files with root-level permissions, remote code execution (RCE), and unauthorized command execution. Exploitation could also result in denial of service (DoS) conditions, theft of sensitive information, business email compromise (BEC), or further penetration into a victim’s IT network. No detailed code analysis or proof-of-concept (PoC) exploit code is publicly available at this time. Numerous national CERT agencies have issued alerts for CVE-2026-104286 [1][2][3][4][5][6][7][8][9][10][11][12][13][14].

Risk Assessment for CVE-2026-104286 in Fortinet FortiMail

CVSS 9.8 · CriticalEPSS 2.2% (82nd)Actively exploitedIn CISA KEV

FortiMail is an email security solution deployed as a physical or virtual appliance. The product is intended to defend organizations against phishing, business email compromise (BEC), and malware. An exploitable software vulnerability in FortiMail could cause disruption to essential email security controls, data theft, and allow an attacker to establish a persistent foothold within a victim’s network.

Persistent access to a FortiMail device allows an attacker to read email that traverses the device or previous email messages if the device is configured to archive email. Furthermore, a persistent foothold may allow an attacker to move laterally to other exposed systems on the same network. If exposed on the public internet, a compromised device could be used as a proxy for subsequent global cyberattacks.

CVE-2026-104286 presents an especially high risk because it can be exploited remotely without authentication. Fortinet’s description says CVE-2026-104286 allows “arbitrary file write”, indicating that attackers can reach files with root-level permissions. Although Fortinet’s initial Indicators of Compromise (IoC) included a list of added files and highly privileged modified files, these were subsequently removed.

Technical Details for CVE-2026-104286 in Fortinet FortiMail

Technical details for CVE-2026-104286 are limited. Fortinet’s FG-IR-26-175 advisory indicates that FortiMail’s webmail interface exposes the vulnerable attack surface and that the flaw combines path traversal [CWE-22] with improper neutralization of a NULL byte or NULL character [CWE-158]. Exploitation allows an unauthenticated attacker to write arbitrary files on the underlying system and achieve unauthenticated RCE. Fortinet’s description, “arbitrary file write”, implies that root-level privileged access is possible. The official workaround guidance further indicates that Identity Based Encryption (IBE) encryption is the affected component.

Affected Product and Mitigation for CVE-2026-104286 in Fortinet FortiMail

FortiMail users should update to a fixed release. The 7.2.x branch is affected, but no corresponding fixed version is available. The 7.2.x branch reached End of Engineering Support (EOES) on May 10th, 2025, and will officially reach End of Support (EOS) on November 10th, 2026.

Fortinet recommends disabling (IBE) encryption support or disabling the entire FortiMail webmail interface as a temporary mitigation. CISA has also flagged CVE-2026-104286 for forensic triage per BOD 26-04.

Affected versions	Fixed versions
8.0.0 – 8.0.1	8.0.2
7.6.0 – 7.6.6	7.6.7
7.4.0 – 7.4.8	7.4.9
7.2.0 – 7.2.9	No fixes available

Summary

CVE-2026-104286 is a critical, actively exploited vulnerability in the FortiMail IBE encryption exposed via the webmail interface. The flaw can be exploited remotely without authentication via HTTP/HTTPS requests to trigger file writes with root-level permissions, and unauthenticated RCE. A breach could also lead to business email compromise (BEC), unauthorized access to sensitive email content, DoS conditions, or broader network penetration.