Critical Fortinet FortiMail Zero-Day: CVE-2026-104286 Enables Unauthenticated Arbitrary File Writes

In October 2026, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation targeting Fortinet FortiMail email security gateways. This CVSS 9.8 vulnerability arises from the intersection of improper pathname limitation (CWE-22) and improper neutralization of null bytes (CWE-158) within the web management interface. Unauthenticated attackers can leverage crafted HTTP requests containing path traversal sequences and null bytes to bypass directory restrictions, allowing arbitrary file writes outside the intended web root. This flaw enables remote code execution (RCE) through webshell deployment, potential credential theft from mailboxes, and subsequent lateral movement within corporate networks.

• Vulnerability Mechanics: Path Traversal and Null Byte Injection
• Root cause involves insufficient validation of user-supplied pathnames (CWE-22), allowing directory escape via traversal sequences.
• Failure to neutralize null bytes (CWE-158) allows attackers to truncate filename checks in backend processes, bypassing extension validations.

• Attack vector involves unauthenticated HTTP requests to file upload or configuration endpoints using payloads such as ../../../etc/passwd%00.

• Exploitation Profile and Observed Impact

• Actively exploited in the wild to deploy webshells for persistent access to the gateway.
• Facilitates remote code execution (RCE) and unauthorized access to sensitive mailbox data and stored credentials.
• Enables lateral movement to connected internal resources, including Active Directory (AD) and sensitive file shares.

• High CVSS 9.8 score reflects critical impact on confidentiality, integrity, and availability with low attack complexity.

• Detection and Threat Hunting Strategies

• Monitor filesystem integrity for unexpected writes in non-web directories, specifically looking for new .php, .jsp, or .sh files.
• Analyze web server logs for anomalous HTTP requests containing path traversal patterns (../) or null-byte characters (%00).

• Inspect outbound traffic from FortiMail gateways for suspicious connections to unauthorized external command-and-control (C2) IPs.

• Mitigation and Remediation Guidance

• Implement immediate workarounds: disable the affected web interface feature or restrict access via ACLs to trusted IP ranges.
• Apply the official Fortinet patch (refer to advisory FGIR26175) immediately upon release.
• Enforce strict network segmentation between the FortiMail gateway and critical internal network segments to limit blast radius.