CVE-2026-104286

Vendor

Fortinet

Product

FortiMail

CVSS

8.7

EPSS

0.022 (p82)

CISA KEV

added 1 Oct 2026, due 4 Oct 2026 (28d overdue)

Weakness

CWE-22, CWE-158

Exposure class

Email

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 75
   KEV CISA KEV 1 Oct 2026

   Fortinet FortiMail Path Traversal Vulnerability

   Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted…

   KEV · due 4 Oct 2026 (overdue) Fix available CVE-2026-104286 Fortinet
2. 65
   CISA alert CISA 30d ago

   CISA Adds One Known Exploited Vulnerability to Catalog

   CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability This type of vulnerability is a…

   Exploited CVE-2026-104286 Fortinet
3. 55
   Ivanti advisory Ivanti 18d ago

   October 2026 Patch Tuesday

   What's happened since September Patch Tuesday Here’s a fun fact to start this month. Ivanti’s Vulnerability Knowledge Base is now tracking more than 406,000 CVEs. Over 78,000 of them were disclosed in 2026 alone, which is more…

   Exploited CVSS 8.7 No fix yet CVE-2026-88779CVE-2026-104286CVE-2026-102255+11 more Ivanti