CVE-2026-104286

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 7, 2026

Description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Fortinet	FortiMail	8.0.0; >= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.6; >= 7.2.0, <= 7.2.9; >= 7.0.0, <= 7.0.9

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-175Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286US Government Resource

Timeline

Published: Oct 1, 2026
Last modified: Oct 7, 2026
Added to CISA KEV: Oct 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-10434.4The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to CVE-2026-1043136.1The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' par CVE-2026-1043325.5IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with CVE-2026-1043349.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.CVE-2026-1043358.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.CVE-2026-1043407.8Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of t CVE-2026-1043417.8Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cur CVE-2026-1043427.8Adobe Framemaker is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current u CVE-2026-1043435.5Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-1043447.8Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of t CVE-2026-1043457.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke CVE-2026-1043467.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu