Critical FortiMail Path Traversal Bug Actively Targeted by Attackers, Scores 9.8 on CVSS

Fortinet has confirmed a critical flaw in its FortiMail email security platform that is being exploited in the wild, according to the company’s latest advisory. The vulnerability, catalogued as CVE-2026-104286, carries a CVSS v3.1 rating of 9.8, placing it in the highest severity tier.

The issue stems from a path‑traversal weakness that allows an unauthenticated remote actor to write arbitrary files to the underlying operating system of the appliance. By placing malicious code in a location that the system later executes, attackers can gain full control of the FortiMail unit, effectively bypassing the very defenses it is meant to provide.

FortiMail appliances sit at the frontline of corporate email traffic, scanning inbound and outbound messages for malware, phishing, and data loss. Compromise of such a device can enable threat actors to intercept, alter, or exfiltrate email content, and to use the compromised appliance as a foothold for lateral movement within an organization’s network. The high CVSS score reflects both the ease of exploitation—no credentials are required—and the breadth of potential impact.

Fortinet’s response includes the release of firmware updates that remediate the flaw and a set of mitigation steps for customers who cannot apply patches immediately. The advisory urges administrators to install the updates without delay, review system logs for signs of unauthorized file writes, and restrict network access to the management interfaces of FortiMail devices.

The active exploitation of this vulnerability underscores a growing pattern where attackers focus on security‑focused hardware and software, seeking to turn protective tools into entry points. Industry analysts note that such attacks often surface shortly after public disclosure, emphasizing the importance of rapid patch deployment and continuous monitoring.

Security researchers and incident‑response teams are monitoring for indicators of compromise linked to CVE-2026-104286, and Fortinet has pledged to provide additional guidance as more information becomes available. Organizations are advised to verify that all FortiMail installations are running the patched firmware, to enforce strong authentication for administrative access, and to segment email security appliances from critical internal assets to limit the blast radius of any potential breach.