CVE-2026-104286Vulnerability
Fortinet FortiMail Path Traversal Vulnerability
Reported by 12 independent sources · first reported by CISA advisories · last reported
Last reported 10 days ago
Fix due 4 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 82% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
17 reports, newest first · the exact sentence from each-
Top RCE Vulnerabilities“CVE-2026-104286”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“FortiMail zero-day: Fortinet has released patches for a new zero-day in its FortiMail product, tracked as CVE-2026-104286.”
-
Path Traversal en FortiMail de Fortinet“Fortinet y CISA han confirmado la explotación activa de CVE-2026-104286.”
-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“The flaw, CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.”
-
Bulletin d'actualité CERTFR-2026-ACT-042 (05 octobre 2026)“CVE-2026-104286”
-
Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited“Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)”
-
FortiMail Zero-Day Under Active Exploitation“Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live.”
-
Fortinet security advisory (AV26-989)“Fortinet indicates that CVE-2026-104286 is exploited in the wild.”
-
Fortinet sounds the alarm over actively exploited FortiMail zero-day“The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform.”
-
Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)“Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)”
-
Path Traversal en FortiMail de Fortinet“CVE-2026-104286: vulnerabilidad de path traversal y neutralización incorrecta de caracteres nulos en la interfaz gráfica de FortiMail.”
-
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action“Tracked as CVE-2026-104286 (CVSS score of 9.8), the zero-day is a path traversal and an improper neutralization of NULL byte or NULL character flaw that could allow attackers to write arbitrary files to the underlying system.”
-
NCSC-2026-0398 [1.00] [M/H] Kwetsbaarheid verholpen in Fortinet FortiMail“FortiMail bevat een kritieke kwetsbaarheid (CVE-2026-104286) in de verwerking van bestandspaden, veroorzaakt door een combinatie van Path Traversal (CWE-22) en onvoldoende neutralisatie van NULL-bytes (CWE-158).”
-
U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog“Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiMail flaw, tracked as CVE-2026-104286 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.”
-
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes“The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.”
-
Vulnérabilité dans Fortinet FortiMail (02 octobre 2026)“Fortinet indique que la vulnérabilité CVE-2026-104286 est activement exploitée.”
-
CISA Adds One Known Exploited Vulnerability to Catalog“CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability”
Indicators reported together
named in the same reports- apply.fbijobs[.]govin 2 reports
- 79.141.169[.]187in 2 reports
- 45.129.0[.]192in 2 reports
- www.moxa[.]comin 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2026-88772, CVE-2026-76504, CVE-2026-88779, CVE-2026-93616, CVE-2026-94127, CVE-2026-89078, CVE-2026-93577, CVE-2026-85102, CVE-2026-86950, CVE-2026-102331, CVE-2026-102489, CVE-2026-102490, CVE-2026-60004, CVE-2026-33824, CVE-2026-81963
Thanks — we review every report.