02 October 2026
Reference: CVE-2026-104286
1. What is being reported?
Fortinet FortiMail versions 7.2.0 through 8.0.1 have a vulnerability called 'path traversal'. This means an attacker can trick the system into saving files in places they shouldn’t be able to, without needing to log in. This can happen through specially crafted web requests.
2. What this means in plain English
If your organisation uses FortiMail, attackers could use this flaw to place harmful files on your system. This might let them take control, steal information, or disrupt your email services. Because the flaw can be exploited remotely and without a password, it is very risky.
3. Could this affect a small business?
Small organisations using FortiMail versions listed are at risk, especially if the device is accessible from the internet. If you do not use FortiMail or it is not internet-facing, you are likely not affected. Check with your IT provider to confirm.
4. What to do now
- Contact your IT provider or Fortinet support immediately to check if your FortiMail version is affected.
- Apply any security updates or patches Fortinet provides as soon as possible.
- If patches are not yet available, follow Fortinet’s recommended mitigations to reduce risk.
- Review whether your FortiMail device is accessible from the internet and restrict access if possible.
5. Ask your IT provider
Can you confirm if our FortiMail system is affected by the CVE-2026-104286 vulnerability, and what steps are being taken to protect us?
6. Bottom line
If you use FortiMail, act quickly to update or secure it to prevent serious security breaches.
Information based on CISA KEV, NVD and multiple reputable security news reports.