CVE-2026-104286 Fortinet FortiMail
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions…
- CVSS
- 9.8 Critical
- EPSS
- 4.6%
- Percentile
- 92
- Published
- 2026-10-01
- Force
- 10 of 12
- Public PoC
- 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
On CISA’s exploited list
Fortinet FortiMail Path Traversal Vulnerability
- Added
- 2026-10-01
- Federal patch deadline
- 2026-10-04
- Ransomware use
- not known