Loading vulnerability…
CVE-2026-104286 is a path traversal vulnerability combined with improper NULL-byte neutralization in the Fortinet FortiMail web interface supporting Identity-Based Encryption (IBE). An unauthenticated remote attacker can submit crafted HTTP or HTTPS requests to write arbitrary files outside the intended directory on the underlying system, potentially enabling unauthorized code or command execution. Affected versions include FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. Fortinet confirmed exploitation in the wild, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 1, 2026.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 2 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
223 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical path traversal vulnerability in Fortinet FortiMail caused by improper NULL-byte neutralization. Exploitation can allow arbitrary file writes outside intended directories. Depending on permissions and appliance configuration, this could support malicious file placement, configuration changes, persistence, or follow-on compromise. The content reports an October 4, 2026, federal remediation deadline and a requirement for forensic triage.
A critical vulnerability in Fortinet FortiMail combining path traversal and improper NULL-character handling permits unauthenticated arbitrary file writes through crafted HTTP or HTTPS requests. File-write access could enable attackers to plant code and access email traversing the gateway. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 1, with an October 4 deadline for federal agencies to perform forensic triage and mitigate. The content recommends immediate remediation and reviewing internet-facing appliances for unexpected files and unusual web requests.
A pathname-restriction vulnerability affecting FortiMail. The advisory lists affected versions as 8.0 before 8.0.2, 7.6 before 7.6.7, 7.4 before 7.4.9, and branch 7.2, which requires upgrading to branch 7.4 or above. Its CISA Known Exploited Vulnerabilities reference indicates known exploitation, but the content provides no exploitation details or specific impact.
A critical unauthenticated path traversal vulnerability in Fortinet FortiMail permits arbitrary file writes through crafted web requests. Exploitation can compromise the email gateway and enable persistent access, email interception, credential theft, and manipulation of filtering. Reported compromise indicators include changes to ld.so.preload, an added liblog.so file, and modified web server configuration. CISA added the vulnerability to its KEV catalog and set an Oct. 4 remediation deadline for federal agencies.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.