Fortinet FortiMail Improper limitation of a pathname to a restricted directory

CVE v události 1

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.8.

Jak se o tom psalo 11

1. 13. 10. 2026 · zachyceno 20:00 · Fortinet PSIRT US

   SQL command injection in webmail

   CVSSv3 Score: 7.7 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00

2. 3. 10. 2026 · zachyceno 04:00 · NCSC-FI FI nadpis události

   Fortinet FortiMail Improper limitation of a pathname to a restricted directory

   Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.0: 9.8, CVEs: CVE-2026-104286, Summary: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. This has been reported to be exploited in the wild, customers are urged to apply…

3. 2. 10. 2026 13:37 · Cyber Centre Kanada CA

   Fortinet security advisory (AV26-989)

   Serial number: AV26-989 Date: October 1, 2026 As of October 1, 2026, Fortinet is affected by vulnerabilities in the following products: FortiMail 8.0 Versions prior to 8.0.2 FortiMail 7.6 Versions prior to 7.6.7 FortiMail 7.4 Versions prior to 7.4.9 FortiMail 7.2 Upgrade to branch 7.4 or above Fortinet indicates that CVE-2026-104286 is exploited in the wild. On October 1, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104286 to their Known Exploited Vulnerabilities…

4. 2. 10. 2026 13:30 · CERT-SE SE

   Kritisk sårbarhet i FortiMail

   Fortinet har publicerat information om en kritisk sårbarhet i FortiMail. Sårbarheten, CVE-2026-104286, har fått en CVSS-klassning på 9.8 och påverkar FortiMail managements gränssnitt. Ett framgångsrikt utnyttjande kan innebära att en oautentiserad angripare kan skriva godtyckliga filer till underliggande system genom HTTP eller HTTPS-anrop. [1]

5. 2. 10. 2026 13:28 · DNSC Rumunsko RO

   ALERTĂ: Vulnerabilitate critică la nivelul Fortinet FortiMail

   DESCRIERE Experții în securitate cibernetică au descoperit o vulnerabilitate critică, CVE-...

6. 2. 10. 2026 09:21 · NCSC-NL NL

   NCSC-2026-0398 [1.00] [M/H] Kwetsbaarheid verholpen in Fortinet FortiMail

   Fortinet heeft een kwetsbaarheid verholpen in FortiMail. FortiMail bevat een kritieke kwetsbaarheid (CVE-2026-104286) in de verwerking van bestandspaden, veroorzaakt door een combinatie van Path Traversal (CWE-22) en onvoldoende neutralisatie van NULL-bytes (CWE-158). Een niet-geauthenticeerde aanvaller kan via speciaal vervaardigde HTTP- of HTTPS-verzoeken willekeurige bestanden op het onderliggende systeem schrijven. De kwetsbaarheid wordt actief geëxploiteerd. Getroffen zijn FortiMail 7.2…

7. 2. 10. 2026 08:36 · CSIRT Itálie (ACN) IT

   Fortinet: rilevato sfruttamento in rete della CVE-2026-104286 relativa a FortiMail

   Rilevato lo sfruttamento in rete di una vulnerabilità critica, identificata tramite la CVE-2026-104286, in FortiMail, soluzione Fortinet per la sicurezza della posta elettronica.

8. 2. 10. 2026 · zachyceno 17:00 · CERT-FR – avis FR

   Vulnérabilité dans Fortinet FortiMail (02 octobre 2026)

   Une vulnérabilité a été découverte dans Fortinet FortiMail. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. Fortinet indique que la vulnérabilité CVE-2026-104286 est activement exploitée. Des indicateurs de compromission sont disponibles dans l'avis de l'éditeur.

9. 2. 10. 2026 00:42 · BleepingComputer US

   Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

   Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]

10. 1. 10. 2026 · zachyceno 22:00 · Fortinet PSIRT US

    Improper limitation of a pathname to a restricted directory

    CVSSv3 Score: 9.8 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.This has been reported to be exploited in the wild, customers are urged to apply the workaround below. Revised on 2026-10-01 00:00:00

11. 1. 10. 2026 · zachyceno 22:00 · CISA KEV US

    Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286)

    CISA added CVE-2026-104286 to the Known Exploited Vulnerabilities catalog. Affected product: Fortinet FortiMail. Remediation due date: 2026-10-04.