CRITICAL 9.8 NVD ACTIVELY EXPLOITED
CVE-2026-104286
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 throu
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-175
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286
This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-10-01 via NVD. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild.
Risk Timeline
CVE Disclosed2026-10-01 · -1 days ago
CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity
Remediation Resources
vulnfeed aggregates 9446 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.