{"id":"CVE-2026-104286","kind":"vulnerability","aliases":["CVE-2026-104286"],"related":[],"title":"fortinet fortimail: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet…","description":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"FortiMail path traversal plus NULL byte flaw (CWE-22/158) in the IBE web endpoint lets an unauthenticated attacker write arbitrary files over HTTP(S), which can lead to code execution. CVSS 9.8, exploited in the wild as a zero-day, and in CISA KEV since Oct 1, 2026. FortiMail Cloud was patched by Fortinet on Oct 5.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-10-01T00:00:00+00:00","products":[{"name":"Fortinet FortiMail","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Fortinet FortiMail","fixed":["7.4.9","7.6.7","8.0.2"],"affected":">= 7.2.0, <= 7.2.9; >= 7.4.0, <= 7.4.8; >= 7.6.0, <= 7.6.6; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"fortinet fortimail","fixed":[],"affected":">= 7.2.0, <= 7.4.8","ecosystem":"vendor"},{"name":"fortinet fortimail","fixed":[],"affected":">= 7.6.0, <= 7.6.6","ecosystem":"vendor"},{"name":"fortinet fortimail","fixed":[],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email-gateway","exploited","fortimail","fortinet","ibe","poc-public","self-hosted","vendor","zero-day"],"not_affected_if":["fortimail-cloud","ibe-disabled","managed-hosting","not-fortimail"],"how_to_check":"Run 'show system encryption ibe' or look in the GUI under Encryption > IBE to see whether IBE Service is on (NCSC-NL says only IBE-enabled units are affected). Check the version with 'get system status': vulnerable is 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, 8.0.0-8.0.1. Hunt for Fortinet's IOCs: source IPs 79.141.169.187 and 45.129.0.192; a root cron event log entry running '/bin/sh -c O=/migadmin ...'; an unexpected archive account 'archive234' with remote-ip 79.141.169.187; IBE log lines 'Invalid Base64 Encoding at pos 0. Character=0x2a'. Also look for POST requests to /ibe containing '../' in web or WAF logs.","fix":"Upgrade to 7.4.9, 7.6.7 or 8.0.2 or later. FortiMail 7.2 has no fix in its own branch: move to 7.4 or later. Until patched, turn IBE off (GUI: Encryption > IBE > IBE Service off; CLI: config system encryption ibe / set status disable / end), or block internet access to the webmail interface, or have a WAF block POSTs to /ibe containing '../'. If IOCs match, treat the box as compromised and investigate (CISA asks for forensic triage).","status":"open","published_at":"2026-10-01T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:07+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-23T19:50:07Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and vendor patch per Fortinet's advisory, as directed by CISA KEV; affected and fixed versions are unknown from the sources.\nIf no mitigation is available, discontinue use of the product per CISA guidance.","summary":"Fortinet FortiMail has a path traversal flaw combined with NULL byte handling that lets an unauthenticated remote attacker write arbitrary files on the server through crafted HTTP or HTTPS requests. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["fortimail","fortinet","self-hosted","email-gateway"],"confidence":0.7,"analyst_note":"Find Fortinet's PSIRT advisory for this CVE to get affected and fixed versions, IOCs, and the vendor mitigation steps; check the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","not-fortimail"],"severity_if_unknown":"critical"},"cost_usd":0.000424,"input_tokens":2229,"output_tokens":403,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find Fortinet's PSIRT advisory for this CVE to get affected and fixed versions, IOCs, and the vendor mitigation steps; check the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286.","search":"'-04':164C,190C,221C '-104286':20A,23A '-2026':19A,22A '-22':59B '/158':60B '1':99B '2026':100B '26':163C,189C,220C '5':109B '9.8':83B 'accord':153C 'action':149C 'adher':217C 'allow':129C 'appli':150C 'applic':187C 'arbitrari':71B,135C 'asset':211C 'attack':69B,132C 'base':168C 'bod':162C,188C,219C 'byte':56B,122C 'charact':125C 'cisa':95B,147C,160C,177C 'cloud':102B,193C 'code':80B 'complianc':158C 'contain':112C 'craft':142C 'cve':18A,21A 'cvss':82B 'cwe':58B 'day':50B,92B 'directori':12A 'discontinu':196C 'email':35B 'email-gateway':34B 'endpoint':65B 'ensur':157C,216C 'evalu':209C 'execut':81B 'exploit':37B,84B 'exposur':214C 'file':72B,136C 'flaw':57B 'follow':186C 'forens':179C 'fortimail':2A,25A,27A,29A,31A,33A,38B,51B,101B,111C 'fortinet':1A,17A,24A,26A,28A,30A,32A,39B,106B,110C 'gateway':36B 'guidanc':175C,191C 'guidelin':223C 'host':46B 'http':74B,143C 'https':145C 'ibe':40B,63B 'improp':4A,118C 'instruct':156C 'internet':213C 'kev':96B 'lead':78B 'let':66B 'limit':5A 'may':128C 'mitig':151C,202C 'neutral':119C 'note':174C,185C 'null':55B,121C,124C 'oct':98B,108B 'patch':104B,222C 'path':13A,52B,114C 'pathnam':8A 'plus':54B 'poc':42B 'poc-publ':41B 'priorit':165C 'product':200C 'public':43B 'request':146C 'requir':148C,181C 'respons':207C 'restrict':11A 'risk':170C 'secur':166C 'see':171C,182C 'self':45B 'self-host':44B 'servic':194C 'sinc':97B 'stakehold':205C 'system':140C 'travers':14A,53B,115C 'triag':180C 'unauthent':68B,131C 'unavail':204C 'under':139C 'updat':167C 'url':172C,183C 'use':197C 'vendor':47B,155C 'via':141C 'vulner':15A,126C 'web':64B 'wild':87B 'write':70B,134C 'zero':49B,91B 'zero-day':48B,90B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-01T00:00:00+00:00","kev":{"dateAdded":"2026-10-01","dueDate":"2026-10-04","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-104286","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286","severity":null,"published_at":"2026-10-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104286:5","url":null,"severity":null,"published_at":"2026-10-23T20:14:47+00:00","modified_at":"2026-10-23T20:14:47+00:00","first_seen_at":"2026-10-23T20:14:47+00:00","fetched_at":"2026-10-23T20:14:47+00:00","note":"Fortinet PSIRT FG-IR-26-175 (Oct 1, updated Oct 7): CVSS 9.8, exploited as zero-day, fixes 7.4.9/7.6.7/8.0.2; workaround is disabling IBE. No public PoC found. NCSC-NL says exposure requires IBE enabled; the PSIRT page does not state that condition."},{"source":"nvd","external_id":"CVE-2026-104286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104286","severity":null,"published_at":"2026-10-01T20:17:24+00:00","modified_at":"2026-10-07T18:17:15+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/fortimail-cve-2026-104286-check","url":"https://github.com/CompleteTech-LLC/fortimail-cve-2026-104286-check","severity":null,"published_at":"2026-10-23T23:43:25+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null}],"documents":[{"id":11,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175","title":"Fortinet PSIRT FG-IR-26-175 FortiMail path traversal","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":11,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175","title":"Fortinet PSIRT FG-IR-26-175 FortiMail path traversal","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":12,"url":"https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/","title":"BleepingComputer: FortiMail zero-day","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":13,"url":"https://advisories.ncsc.nl/2026/ncsc-2026-0398-0.pdf","title":"NCSC-NL 2026-0398","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":2248,"url":"https://github.com/CompleteTech-LLC/fortimail-cve-2026-104286-check","title":"CompleteTech-LLC/fortimail-cve-2026-104286-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-104286: Fortinet FortiMail: Path traversal / NULL-byte arbitrary file write. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:43:25+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}