Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) - Unauthenticated Arbitrary File Write

• Apply Security Patches: Update to the following versions as per the vendor advisory:
• FortiMail 8.0.2 or higher
• FortiMail 7.6.7 or higher
• FortiMail 7.4.9 or higher
• FortiMail 7.2.10 or higher

• Access Control: Disable administrative access (HTTP/HTTPS) on external-facing interfaces and use Trusted Hosts/VPN for management.

   config system interface
     edit "port1"
       set allowaccess ping ssh # Remove http/https if not strictly necessary
     next
   end

• Monitoring: Review system logs for unusual file creation events in web directories and monitor for unauthorized administrative logins.

CVE-2026-104286 is a critical Path Traversal (CWE-22) vulnerability in Fortinet FortiMail. The flaw exists due to improper limitation of pathnames within the web-based management interface. An unauthenticated attacker can exploit this by sending specially crafted HTTP or HTTPS requests containing directory traversal sequences. Unlike typical traversal flaws that only allow data leakage, this vulnerability permits arbitrary file writes. This allows an attacker to overwrite critical system binaries, configuration files, or plant web shells, effectively gaining root-level access to the appliance. Given its inclusion in the CISA KEV catalog and an EPSS score of 0.94, this vulnerability is a primary target for automated exploitation and ransomware groups.