Dashboard / CVE-2026-104286

CVE-2026-104286

CRITICAL CISA KEV
ACT NOW Priority: 0.45 BB Relevance: 81/100
Published: 2026-10-01 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

CISA Known Exploited Vulnerability

Vendor / Product Fortinet — FortiMail
Date Added 2026-10-01
Remediation Due 2026-10-04
https://fortiguard.fortinet.com/psirt/FG-IR-26-175 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-104286

Weakness Classification (1)

Affected Software (40)

VendorProductVersion
Fortinet FortiMail 8.0.0
Fortinet FortiMail 7.6.0
Fortinet FortiMail 7.4.0
Fortinet FortiMail 7.2.0
Fortinet FortiMail 7.0.0
Fortinet FortiMail 8.0.0
Fortinet FortiMail 7.6.0
Fortinet FortiMail 7.4.0
Fortinet FortiMail 7.2.0
Fortinet FortiMail 7.0.0
Fortinet FortiMail 8.0.0
Fortinet FortiMail 7.6.0
Fortinet FortiMail 7.4.0
Fortinet FortiMail 7.2.0
Fortinet FortiMail 7.0.0
Fortinet FortiMail 8.0.0
Fortinet FortiMail 7.6.0
Fortinet FortiMail 7.4.0
Fortinet FortiMail 7.2.0
Fortinet FortiMail 7.0.0
Fortinet FortiMail 8.0.0
Fortinet FortiMail 7.6.0
Fortinet FortiMail 7.4.0
Fortinet FortiMail 7.2.0
Fortinet FortiMail 7.0.0
Fortinet FortiMail 8.0.0
Fortinet FortiMail 7.6.0
Fortinet FortiMail 7.4.0
Fortinet FortiMail 7.2.0
Fortinet FortiMail 7.0.0
Showing 30 of 40 entries

References & Advisories (2)

Bug Bounty Relevance

81 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ Known exploited (KEV)

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

EPSS — Exploitation Probability

4.57%
Raw Score 0.045730
Percentile 91.6%
Date 2026-10-28

Intelligence Sources

kev ref →
mitre ref →
nvd ref →

External Links