CVE-2026-104286: Fortinet FortiMail Path Traversal and Null Byte Injection Enable Unauthenticated File Write

Background

Fortinet FortiMail is an email security gateway appliance that filters, inspects, and relays email traffic at the network perimeter, similar in role to other mail security gateways that sit directly in an organization’s internet-facing mail flow. FortiMail, like other Fortinet appliances (FortiOS, FortiGate, FortiSandbox), has been a recurring target for advanced attackers, in part because of the broad trust these edge security devices are granted within the networks they protect.

CVE-2026-104286 combines two related weaknesses — path traversal and improper neutralization of a NULL byte or NULL character — that together allow an unauthenticated attacker to write arbitrary files on the underlying operating system via crafted HTTP or HTTPS requests. As with other recent Fortinet KEV entries, this represents an unauthenticated, network-reachable primitive on a security appliance that is specifically trusted with inspecting an organization’s email traffic.

Technical Mechanism

CISA’s KEV entry associates this vulnerability with two weaknesses: CWE-22 (Path Traversal) and CWE-158 (Improper Neutralization of Null Byte or NULL Character). These two weaknesses frequently combine in a well-known exploitation pattern:

1. CWE-22 — Path Traversal: A FortiMail HTTP/HTTPS-facing component accepts a filename or path parameter that is used to construct a file-system path, and the traversal sequences within it (../) are not properly sanitized, allowing the attacker to specify a destination path outside the intended directory.
2. CWE-158 — Null Byte Injection: Historically, many web application frameworks and underlying libraries truncate a string at an embedded NULL byte (%00) when performing file extension or type validation, while the underlying OS file-write call still processes the full string including content after the NULL byte. An attacker can exploit this mismatch to defeat extension allow-lists or path-sanity checks that only inspect the string up to the NULL byte, while the actual file write proceeds using the attacker’s full intended path and filename.
3. Combined, an attacker crafts an HTTP or HTTPS request to FortiMail containing a path-traversal sequence and a NULL byte designed to bypass any file-type or path validation logic that only examines the truncated string, resulting in an arbitrary file being written to a location of the attacker’s choosing on the underlying operating system — all without authentication.

The CVSS 9.8 score — network-exploitable, no authentication, no user interaction required — is consistent with this being a pre-authentication file-write primitive reachable directly over HTTP/HTTPS.

Real-World Exploitation Evidence

CVE-2026-104286 is listed in CISA’s KEV catalog, added on 2026-10-01, confirming active exploitation in the wild per CISA’s inclusion criteria. CISA lists knownRansomwareCampaignUse as “Unknown” for this entry — CISA has not confirmed this specific vulnerability is tied to a named ransomware campaign as of KEV addition.

No specific threat actor or campaign name has been publicly attributed to exploitation of CVE-2026-104286 in the data available to us. The KEV listing confirms real-world exploitation has occurred; attribution detail has not been made public at this time. Fortinet’s PSIRT advisory (FG-IR-26-175) is the authoritative vendor source for further detail as it becomes available. Fortinet’s product line has a documented history of being targeted by capable threat actors exploiting edge-device vulnerabilities for initial access and persistence, which is relevant context even though no specific attribution for this CVE is yet public.

Impact Assessment

An unauthenticated arbitrary file write on an internet-facing email security gateway, reachable via crafted HTTP/HTTPS requests, carries severe downstream risk:

• Integrity: The attacker-controlled file write can be directed at locations where written content is later executed, interpreted, or trusted by the system — for example, configuration files, scheduled task definitions, or web-served script directories — converting the file-write primitive into a path toward further compromise, potentially including remote code execution.
• Availability: Arbitrary file write can corrupt FortiMail’s configuration or operational files, disrupting the organization’s email filtering and delivery pipeline.
• Confidentiality (indirect): If the file write is escalated to code execution, the attacker gains a position to inspect or intercept the email traffic flowing through the gateway.

Sector-specific risk: As with other internet-facing email security gateways, FortiMail processes an organization’s entire inbound/outbound mail flow, making this a cross-sector risk. Organizations relying on FortiMail as part of a broader Fortinet security stack should also consider that a compromised FortiMail appliance may provide a foothold for lateral movement toward other Fortinet-managed infrastructure on the same network.

Affected Versions

The exact affected FortiMail firmware version range is not specified in the KEV data provided here. Organizations should consult Fortinet’s PSIRT advisory FG-IR-26-175 for the definitive affected and patched version list:

Remediation Steps

CISA’s required action directs applying vendor mitigations in line with BOD 26-04 risk-based patching guidance, following Forensics Triage Requirements, and discontinuing use of the product where mitigation cannot be applied.

1. Apply the Fortinet firmware update referenced in PSIRT advisory FG-IR-26-175 to all FortiMail appliances immediately.

# Confirm current FortiMail firmware version from the CLI
get system status

2. Restrict management and web-facing interfaces from unnecessary internet exposure while patching is completed — limit HTTP/HTTPS-reachable administrative and processing endpoints to trusted network ranges where feasible.
3. Follow Forensics Triage Requirements on any unpatched, internet-facing FortiMail appliance given confirmed active exploitation — treat it as potentially already compromised.
4. Audit the filesystem for unexpected files, particularly in locations with execution, scheduling, or web-serving significance, that may have been placed via this path-traversal/null-byte primitive.
5. Review configuration integrity on all FortiMail appliances following patching to confirm no unauthorized changes were made during the vulnerable window.

Detection Guidance

• Review FortiMail HTTP/HTTPS access logs for requests containing path traversal sequences (../, encoded equivalents) combined with embedded NULL bytes (%00) in filename or path parameters.
• Monitor the appliance filesystem for file creation events outside standard application storage directories, particularly around the dates of suspicious HTTP/HTTPS requests.
• Watch for unexpected process execution, configuration changes, or scheduled task modifications on the FortiMail appliance following anomalous web requests.
• Exact IDS/WAF signatures for this specific CVE should be sourced from Fortinet’s PSIRT advisory and your security vendor’s threat intelligence feed as further detail becomes available; a general rule inspecting for the combination of directory-traversal sequences and null-byte characters in HTTP request parameters is a reasonable interim detection control.

Timeline

References

• Fortinet PSIRT Advisory — FG-IR-26-175
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-104286