FortiMail CVE-2026-104286: unauthenticated file write, CVSS 9.8

Fortinet FortiMail has an unauthenticated file-write flaw, CVE-2026-104286, rated CVSS 9.8, exploitable via crafted HTTP/HTTPS requests. Affected branches are 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9; CISA added it to its Known Exploited Vulnerabilities catalog on October 1, 2026.

• CVSS 3.1 score is 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected: FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9
• CISA added the CVE to its exploited-vulnerabilities catalog on October 1, 2026
• Fortinet did not name which directories the write reaches