CVE-2026-104286

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 28, 2026

Description

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
FortinetFortiMail>= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.8; >= 7.2.0, <= 7.2.9; >= 7.0.0, <= 7.0.9

References

Timeline

Published
Oct 1, 2026
Last modified
Oct 28, 2026
Added to CISA KEV
Oct 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-10434.4The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up toCVE-2026-1043075.4The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, aCVE-2026-1043084.3IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralizatioCVE-2026-1043096.5IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitationCVE-2026-1043104.3IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side requeCVE-2026-1043126.8IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry pathsCVE-2026-1043136.1The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parCVE-2026-1043146.5IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flowCVE-2026-1043154.3IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send CVE-2026-1043166.5IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sendinCVE-2026-1043179.8IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the systCVE-2026-1043248.8IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrus
CVE-2026-104286: Critical severity, CVSS 9.8 | Vulnix