CVE-2026-104286 FortiMail: Critical Unauthenticated File Write

CVE-2026-104286 is a path traversal vulnerability in Fortinet FortiMail that allows an unauthenticated attacker to write arbitrary files to the underlying system. The flaw affects versions 7.0 through 8.0.1 and is accessible via crafted HTTP/HTTPS requests. No authentication is required: risk is maximum for any FortiMail deployment exposed to the Internet or reachable from untrusted networks.

Severity is rated CVSS 9.8 (critical) by NVD. The CVE was published 2026-10-01 and as of 2026-10-29 public repositories are tracked claiming to contain exploits. Fortinet has issued official security advisories. Active exploitation in the wild is not yet confirmed, but public exploit availability and the criticality of the flaw (path traversal plus arbitrary file write on mail gateway) make active exploitation highly probable in the days immediately following.

For sysadmins and CISOs: immediately verify FortiMail version in production using management console version information. Access official Fortinet advisories and apply the patch without delay. Meanwhile monitor FortiMail HTTP/HTTPS access logs for unauthenticated activity with suspicious or anomalous paths. If patching is not immediate, evaluate temporary machine isolation or network restrictions. Communicate the risk to business in terms of email availability and potential gateway integrity compromise.