FortiMail CVE-2026-104286 in CISA KEV: Unauthenticated Arbitrary File Write

On October 1, 2026, CISA added CVE-2026-104286 to its KEV catalog. It affects Fortinet FortiMail, Fortinet's email security gateway. Exploited, unauthenticated, with a very short deadline: October 4.

NVD hasn't published a score or affected versions as of writing. Everything below is based on the KEV entry; Fortinet's PSIRT advisory is authoritative for affected and fixed versions.

What the Flaw Does

CISA describes it as a combination of two weaknesses:

a path traversal and an improper neutralization of NULL byte or NULL character vulnerability

In practice: crafted HTTP or HTTPS requests let an unauthenticated attacker write arbitrary files on the underlying system. The path traversal escapes the intended directory; the NULL byte mishandling defeats checks on the filename.

I won't go further. What matters for defenders: writing an arbitrary file on an appliance is almost always one step short of code execution — replacing a script, dropping a configuration, planting a persistent backdoor.

Why It Matters

An email gateway is a mandatory choke point:

• it sees all inbound and outbound mail, attachments included
• it often holds directory integrations (LDAP, Active Directory) and their credentials
• its web interface is frequently internet-facing, for webmail or user quarantine

This isn't the first Fortinet appliance in KEV this year: in July, three FortiSandbox and FortiOS CVEs were added (see our article on the July Fortinet additions). Edge security appliances remain a priority target.

Versions

NVD has published neither affected nor fixed versions as of writing. I won't make any up. Check Fortinet's PSIRT advisory for CVE-2026-104286 and compare it with the version running on each FortiMail appliance (hardware, VM or cloud).

Detection

• Files created or modified on the appliance outside update windows — if Fortinet publishes indicators of compromise or an integrity check tool, use it
• HTTP/HTTPS access logs: unusual anonymous requests to the web interface, especially in bursts, from unknown addresses
• Admin accounts added or modified, mail routing or relay rules changed
• Outbound traffic from the appliance to destinations that are neither MTAs nor Fortinet services

Mitigation

1. Apply Fortinet's fixed release as soon as it's available for your branch. The October 4 CISA deadline says it all: this is an emergency.
2. Restrict the admin interface to management networks. If webmail or quarantine must stay exposed, keep exposure to the bare minimum.
3. Apply the workarounds in Fortinet's advisory if you can't upgrade immediately.
4. Check appliance integrity after upgrading: a patch doesn't remove a file that was already dropped.
5. If compromised: rotate admin credentials and directory integration credentials, and treat mail that transited the gateway as potentially exposed.

Why Continuous Monitoring of Email Gateways Matters

When a flaw lands in KEV before NVD has even published a score, tools that wait for a CVSS to alert stay silent. You need a source that also tracks CISA's catalog, and an inventory that knows where FortiMail runs.

With cveo.tech, inventory your security appliances and get alerted whenever a CVE enters CISA KEV for one of them.