CVE severity: Critical
Check your FortiMail systems for CVE-2026-104286: CERT-FR reported on 2 October that Fortinet had confirmed active exploitation. The vulnerability is also included in CISA’s Known Exploited Vulnerabilities catalog, per NVD record.
What the vulnerability allows
This is a path traversal flaw that allows an attacker not requiring authentication to mount crafted HTTP or HTTPS requests to write files onto the underlying system; CERT-FR lists remote code execution as a possible risk.
Per Fortinet’s CVSS 3.1 score, a value of 9.8 ranks the vulnerability as critical.
Affected versions
Per NVD description, the following FortiMail releases are affected:
- 8.0.0 Through 8.0.1
- 7.6.0 Through 7.6.6
- 7.4.0 Through 7.4.8
- 7.2.0 Through 7.2.9
Before you patch, consult the current Fortinet advisory: the NVD record lists inconsistent version information between its description and other product fields, hence it should not be used alone to select a fixed release.
Patch status and next steps
The 2 October notice by CERT-FR mentions upcoming releases 8.0.2, 7.6.7 and 7.4.9: that notice does not confirm whether these are already available for download.
Review advisory FG-IR-26-175 for the current remediation instructions: CERT-FR further notes that Fortinet has published indicators of compromise. Use these to support an investigation in the event that a system may have been exposed.
Sources
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104286
CERT-FR: https://cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1257/
Fortinet advisory: https://www.fortiguard.com/psirt/FG-IR-26-175