Fortinet FortiMail Path Traversal Vulnerability Added to CISA KEV

What's on the official record

1 October — CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.10.21). The entry describes a path traversal and improper neutralization of NULL byte or NULL character vulnerability (CWE-22, CWE-158) in Fortinet FortiMail that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. CISA's remediation due date for federal civilian agencies is 4 October 2026. The record names no fixed version: Fortinet FortiMail is affected through 7.6.5 and through 7.4.6. FIRST's EPSS model estimates a 0.022 probability of exploitation (82nd percentile, 2026-10-23). CISA's ADP assesses exploitation as active, automatable, with total impact. The catalog does not record known ransomware use.

Assessment

For a platform or AI-stack owner, the record lets you check whether any Fortinet FortiMail deployment in your estate runs a version at or below 7.6.5 or 7.4.6 and whether that instance is reachable over HTTP or HTTPS. The record names no fixed version, so the reader can check whether a vendor patch is available before deciding whether to patch, isolate, or restrict the affected appliance.

For a cyber underwriter, the record lets you check whether a policyholder runs Fortinet FortiMail and, if so, which version and whether it is internet-facing. The record attributes active exploitation and total impact to CISA's ADP, which the reader can weigh when deciding whether to bind, price, exclude, or require a control around unpatched FortiMail exposure.

What would change this call

A vendor advisory naming a fixed version for Fortinet FortiMail would change the call, because the record currently names no fixed version. Confirmation that a specific deployment is internet-facing and unpatched would move the platform owner's decision from isolate to patch.

What to check next

Confidence

The record is the CISA Known Exploited Vulnerabilities Catalog entry and the CVE record for CVE-2026-104286. Filed 25 October 2026 from the record dated 1 October 2026.

Sources

[1] Fortinet FortiMail Path Traversal Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-104286

[2] CVE record CVE-2026-104286 — https://www.cve.org/CVERecord?id=CVE-2026-104286

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog