Is CVE-2026-104286 being exploited?

No public exploit is currently tracked. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

How severe is CVE-2026-104286?

CVE-2026-104286 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-104286

Description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Threat reporting mentioning CVE-2026-104286

Critical FortiMail Vulnerability UnderFortinet has issued a warning regarding a critical vulnerability in FortiMail, tracked as CVE-2026-104286, which is being actively exploited in zero-day attacks. The flaw, rated cr…