CVE-2026-104286CISA KEVEPSS p81.9%

CVE-2026-104286Fortinet FortiMail Path Traversal Vulnerability

Fortinet / FortiMail

Description

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Scoring

CVSS 9.8 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS2.20% probability of exploitation · percentile 81.9% · 2026-10-05T12:00:23Z
Last modified2026-10-02

CISA KEV entry

Added to KEV: 2026-10-01

Sourced from NVD + CISA KEV + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.