CVE-2026-104286: Unauthenticated Path Traversal to Arbitrary File Write in Fortinet FortiMail

Executive Summary

CVE-2026-104286 is an improper pathname limitation (path traversal) flaw that allows an unauthenticated attacker to write arbitrary files on the underlying FortiMail system through crafted HTTP or HTTPS requests. An arbitrary file write on a mail gateway sitting at or near the corporate-to-plant boundary is a direct path to persistent remote code execution and lateral movement toward process control networks.

Technical Exposure Breakdown

The vulnerability is a classic restricted-directory traversal condition in the FortiMail HTTP/HTTPS interface. The grounding data lists affected ranges including FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, 7.2.0 through 7.2.9, and 7.0.0 through 7.0.9. Treat any internet-facing or management-facing FortiMail appliance in these ranges as exposed until proven otherwise.

The attack vector is network-based and requires no authentication. An attacker crafts a request where a pathname parameter escapes its intended directory, allowing a file to be written to an attacker-controlled location on the appliance filesystem. The practical escalation is well understood: write a web-executable payload, a cron or startup artifact, or an SSH key into a path that the system will later execute or trust. From arbitrary file write to arbitrary code execution is a short step on a device like this. The CVSS score is 9.8, consistent with unauthenticated, low-complexity, network-reachable impact.

This CVE is flagged in the known exploited vulnerability catalog. That changes the risk calculus from theoretical to operational. Published patch status is unknown in the grounding data, so do not assume a fix is available or deployed in your environment. Verify version and build directly against your inventory.

OT Impact and Compliance Risk

FortiMail is a mail security appliance, not a controller. The OT relevance is about position, not function. In many utility and industrial enterprises the mail gateway lives in the enterprise DMZ or shared services zone that bridges IT and the OT boundary. A compromised appliance here becomes a staging host for reconnaissance against the historian layer, jump hosts, and engineering workstations. If the appliance has any management reachability into IDMZ segments, the blast radius extends toward the process network.

From a standards view, an unauthenticated foothold on a perimeter appliance undermines the zone and conduit model central to IEC 62443. If this device sits in a defined electronic security perimeter or supports a NERC CIP medium or high impact BES Cyber System environment, CIP-005 and CIP-007 obligations around access control, patch management, and malicious code prevention are directly implicated. Pipeline operators under TSA SD-02C should map this appliance against their required access control and segmentation measures. Water and wastewater utilities under AWIA 2018 should treat a KEV-listed perimeter flaw as a risk assessment trigger, not a routine patch cycle item.

Compensating Controls

Patch availability is unconfirmed, so plan compensating controls as the primary response rather than the fallback.

• Remove the administrative and HTTP/HTTPS interface from any untrusted network. Restrict management access to a hardened admin VLAN with explicit source allow-lists. If the device does not need internet-facing web exposure, terminate it.
• Front the appliance with a reverse proxy or WAF that normalizes and rejects path traversal sequences. Block requests containing encoded and double-encoded traversal patterns such as ../, %2e%2e%2f, and ..%2f in URI and parameter fields.
• Deploy a virtual patch at the network layer. A Suricata rule concept: inspect HTTP request URIs and bodies destined for the FortiMail management port for directory traversal tokens combined with write-indicative methods, alert and drop on match, and log full request context for forensics. Validate the rule against known-good admin traffic to avoid blocking legitimate sessions.
• Enforce strict egress filtering from the appliance. An arbitrary file write that leads to code execution typically needs outbound callback. Deny outbound connections that are not explicitly required for mail delivery and updates.
• Do not run active vulnerability scans across OT-adjacent segments to confirm exposure. Aggressive scanning can disrupt or brick fragile industrial components downstream. Confirm versions from configuration records and passive inventory instead.
• Review filesystem and web logs for unexpected writes, new files in web-servable directories, and anomalous admin interface requests predating detection.

Intel by BreachSpider tracks KEV-listed perimeter exposures like CVE-2026-104286 and their proximity to OT zones so your team can prioritize containment before exploitation reaches the process network.