{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-104286","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","state":"PUBLISHED","assignerShortName":"fortinet","dateReserved":"2026-10-01T19:12:54.081Z","datePublished":"2026-10-01T19:17:38.938Z","dateUpdated":"2026-10-02T11:08:26.387Z"},"containers":{"cna":{"affected":[{"vendor":"Fortinet","product":"FortiMail","cpes":["cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","versions":[{"version":"8.0.0","status":"affected"},{"versionType":"semver","version":"7.6.0","lessThanOrEqual":"7.6.5","status":"affected"},{"versionType":"semver","version":"7.4.0","lessThanOrEqual":"7.4.6","status":"affected"},{"versionType":"semver","version":"7.2.0","lessThanOrEqual":"7.2.9","status":"affected"},{"versionType":"semver","version":"7.0.0","lessThanOrEqual":"7.0.9","status":"affected"}]}],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests."}],"providerMetadata":{"orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","shortName":"fortinet","dateUpdated":"2026-10-02T11:08:26.387Z"},"problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-22","description":"Execute unauthorized code or commands","type":"CWE"}]}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}],"solutions":[{"lang":"en","value":"Upgrade to upcoming  FortiMail version 8.0.1 or above\nUpgrade to upcoming  FortiMail version 7.6.6 or above\nUpgrade to upcoming  FortiMail version 7.4.8 or above\nUpgrade to upcoming  FortiMail version 7.2.10 or above\nUpgrade to FortiRecorder version 7.6.1 or above\nUpgrade to FortiRecorder version 7.2.12 or above\nUpgrade to upcoming  FortiRecorder version 7.0.7 or above"}],"references":[{"name":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-175"}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-01T00:00:00+00:00","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-104286"}}}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286","tags":["government-resource"]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T03:55:37.286Z"}}]}}