Fortinet FortiMail: Fortinet FortiMail Path Traversal Vulnerability
Critical CVSS 9.8 Listed in CISA KEV
Summary
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- Fortinet:FortiMail
- :
Sources
- CISA KEV DATABASE
- NVD DATABASE
- Grok bot vulnerability crawler DATABASE
Original Links
- https://fortiguard.fortinet.com/psirt/FG-IR-26-175 reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-104286 reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286
Timeline
- kev_ingest CISA KEV
- nvd_ingest NVD
- grok_bot_ingest Grok bot vulnerability crawler