CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, no fixed build yet (CVSS 9.8)

Fortinet published advisory FG-IR-26-175 on 2026-10-01 for CVE-2026-104286, a path traversal combined with improper neutralization of a NULL byte in FortiMail that may let an unauthenticated attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests (Fortinet PSIRT, 2026-10-01). Fortinet says the flaw "has been reported to be exploited in the wild" (Fortinet PSIRT, 2026-10-01), its own product-security team found it, and BleepingComputer reports a CVSS score of 9.8 and a flaw in the management interface (BleepingComputer, 2026-10-01). CISA added the CVE to its KEV catalog on 2026-10-01 (CISA KEV, 2026-10-01). No source names an actor, a victim count or when exploitation began.

Affected are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9; the advisory lists 8.0.2, 7.6.7 and 7.4.9 as upcoming fixes and tells 7.2 users to move to branch 7.4 or above, and no fix is listed as of 2026-10-02 (Fortinet PSIRT, 2026-10-01); BleepingComputer reads the 7.2 row as a patch by upgrading to the 7.4 branch or later, but 7.4.0 through 7.4.8 are themselves affected, so Fortinet's table is followed here (BleepingComputer, 2026-10-01). The workarounds are to disable IBE feature support with a CLI command, or to disable internet access to the management interface or limit it to trusted private networks (Fortinet PSIRT, 2026-10-01).

Fortinet's compromise section shows what exploitation left behind: a shared library added under the appliance's data partition with an ld.so.preload entry, a modified system binary, added service binaries, a modified web server configuration and a modified admin-migration archive; a cron job launched from the migration directory; an admin CLI session that added a mail archive account sending to a remote host; and IBE decrypter exceptions for invalid Base64 input plus failed internal-user logins (Fortinet PSIRT, 2026-10-01). BleepingComputer reads the archive account as a possible path to send archived data to a remote server (BleepingComputer, 2026-10-01).

Exposure: every FortiMail on the four listed branches; the vendor's two workarounds point to the IBE feature and the management interface as the reachable surface, so whether either is exposed to the internet is the first check (Fortinet PSIRT, 2026-10-01).