Critical FortiMail flaw CVE-2026-104286 exploited in the wild

Fortinet's FortiMail has a path traversal vulnerability CVE-2026-104286 rated CVSS 9.8, letting unauthenticated attackers write files via the web-facing IBE component. CISA added it to its KEV catalog on October 1, 2026, with fixes expected in 8.0.2, 7.6.7 and 7.4.9.

• CVSS 9.8: path traversal CWE-22 combined with NULL byte handling CWE-158
• Affected: FortiMail 7.0.0–7.0.9, 7.2.0–7.2.9, 7.4.0–7.4.6, 7.6.0–7.6.5 and 8.0.0
• ZoomEye fingerprint query returned 3911 FortiMail instances
• No fix for the 7.0 branch; users are advised to move to 7.4 or later