CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Overview
FortiMail, Fortinet's email security gateway, contains a path traversal flaw combined with null byte injection that allows an unauthenticated attacker to write arbitrary files anywhere on the underlying operating system. Affected versions include the 7.2, 7.4, 7.6, and 8.0 release lines. Because no authentication is required and the web interface is commonly internet-facing, a remote attacker who can reach it can plant files, including web shells, without any prior foothold.
Vulnerability details
FortiMail's HTTP and HTTPS request handler fails to restrict file path inputs to an intended directory, the core of CWE-22 path traversal. An attacker supplies traversal sequences such as '../' in path parameters or filenames to escape the restricted working directory and reference arbitrary filesystem locations. CWE-158 null byte injection compounds this: embedding a null character in the crafted path causes the application's filename or extension validation to truncate the string at that byte, bypassing suffix checks that would otherwise reject the request. Together, the two weaknesses allow the attacker to specify both the destination path and the file content freely.
An attacker with network access to the FortiMail web interface sends crafted HTTP or HTTPS requests containing path traversal sequences and embedded null bytes. No authentication is required. A successful request writes attacker-controlled content to an arbitrary location on the host filesystem. Writing a web shell to a directory served by the web interface produces remote code execution; overwriting configuration or executable files can achieve equivalent or greater impact. The only precondition is that the FortiMail web interface be reachable from the attacker's network position.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review FortiMail web access logs for requests containing encoded or literal path traversal sequences ('../', '%2e%2e%2f', '%252e') or null byte characters ('%00') in URI paths or filename parameters, particularly in POST requests that reference file operations.
- Audit the FortiMail filesystem for unexpected files in web-accessible directories or system directories outside the normal application file set, especially files with web shell extensions (.php, .jsp, .py) or recently modified configuration and executable files with no corresponding administrative change record.
Remediation
Additional hardening
- Upgrade FortiMail to a release beyond 8.0.1 for the 8.0 line and beyond 7.6.6 for the 7.6 line; see the vendor advisory in References for all branch boundaries including the 7.4 and 7.2 lines.
- Restrict network access to the FortiMail web interface (HTTP/HTTPS management and any web-facing components) to trusted administrative source addresses using firewall rules or an upstream access control list, removing internet-wide reachability.
- If the web interface cannot be immediately patched or restricted, place FortiMail behind a web application firewall configured to block requests containing path traversal sequences and null byte characters in URI and body parameters.
- Conduct a filesystem integrity check on all exposed FortiMail appliances, comparing current file state against a known-good baseline, to identify any files written prior to patching.
Key dates
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-175
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-104286
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286
Frequently asked questions
Does CVE-2026-104286 affect my FedRAMP authorization?
If Fortinet FortiMail runs inside your authorization boundary, yes. CVE-2026-104286 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of October 4, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. One that is overdue is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-104286?
Knox does not patch your Fortinet FortiMail deployment. Under the FedRAMP shared-responsibility model, that remediation belongs to you. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with Knox's automated continuous monitoring platform and audit-artifact coverage that support documentation of the fix for your next assessment. Applying the patch is your responsibility; managing the compliance posture around it is not something you handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a CVE like CVE-2026-104286, that means exposure surfaces during continuous monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility into what needs to be addressed.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-104286's remediation deadline of October 4, 2026 has passed. What happens now?
An unremediated CVE-2026-104286 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing it out now and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
