Critical severity9.8CISA KEVNVD Advisory· Published Oct 1, 2026· Updated Oct 1, 2026
CVE-2026-104286
CVE-2026-104286
Description
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.