🛡️ CVE-2026-104286

The items that name it 4

• Dark Web Intelligence (@DailyDarkWeb) on X
  thread2026-10-01

  Path traversal + NULL-byte neutralization flaw in Fortinet FortiMail that may let an unauthenticated attacker write arbitrary files via crafted HTTP/HTTPS requests, leading to RCE; added to CISA KEV catalog on October 1, 2026, based on evidence of active exploitation. Severity: Critical (Fortinet CV

• CISA KEV: Fortinet FortiMail CVE-2026-104286 path traversal, actively exploited, no patch yet
  advisoryIt is written here as CVE-2026-104286 (Fortinet FortiMail Path Traversal Vulnerability; added to CISA KEV Catalog based on evidence of active exploitation).

  Fortinet FortiMail Path Traversal Vulnerability; added to CISA KEV Catalog based on evidence of active exploitation

• Critical FortiMail Zero-Day Flaw (CVE-2026-104286)
  advisory

  Critical FortiMail flaw: improper limitation of a pathname to a restricted directory (path traversal, CWE-22) and improper neutralization of NULL byte/character (CWE-158), allowing unauthenticated attackers to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. CVSS sc

• Known Exploited Vulnerabilities Catalog | CISA
  otherIt is written here as CVE-2026-104286 (Fortinet FortiMail path traversal; added 2026-10-01, due 2026-10-04; advisory FG-IR-26-175).

  Fortinet FortiMail path traversal; added 2026-10-01, due 2026-10-04; advisory FG-IR-26-175