FortiMail flaw CVE-2026-104286 is an unauthenticated file write, not a file-read traversal

The bug

Fortinet has disclosed a critical flaw in FortiMail, its email security gateway, that allows an unauthenticated attacker to create files on the appliance through specially crafted HTTP or HTTPS requests. The vulnerability is tracked as CVE-2026-104286 and was published by Fortinet under advisory FG-IR-26-175 with a CVSS 3.1 base score of 9.8. According to a dev.to analysis of the advisory, CISA placed the flaw on its Known Exploited Vulnerabilities catalog on 1 October 2026, a signal that attackers are already using it.

The write-up lists the affected branches as FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

A traversal that writes

Most path traversal disclosures are read problems: the attacker steps outside an intended directory and reads a file that was never meant to be served, often a configuration file. As the dev.to author points out, Fortinet's own description frames this one differently. Here the attacker writes files rather than reads them, and needs no administrator credential, session cookie, or valid mailbox to do it.

That distinction shapes the blast radius. A mail gateway sits at the network edge by design, with an SMTP listener that must accept connections from the internet, a web administration console, and often quarantine or message-trace views used by helpdesk staff. It also holds the mail queue itself: message bodies, attachments, headers, and envelope metadata showing who communicates with whom. An arbitrary file write on such a system could place content where a web server serves it, where a scheduled job picks it up, or where a configuration loader reads it, though the advisory does not say which of those locations are actually reachable.

What is and is not confirmed

Fortinet's advisory says the flaw may permit writing arbitrary files to the underlying system. It does not state that remote code execution follows, and the dev.to analysis warns that several public summaries have blurred exactly that line. The impact of an arbitrary write depends entirely on where the write lands, on the deployment, the software branch, and the file system permissions of the daemon handling the request. Until an advisory or a reproducible public analysis names the reachable paths, code execution should be treated as a hypothesis to test in a lab rather than an established outcome.

The CVSS vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes a network-reachable flaw that requires no privileges and no user interaction, with high impact on confidentiality, integrity and availability inside the appliance's own scope. The dev.to author notes this is the vendor's assessment of the appliance, not of the mail flowing through it.

Recommended steps

The write-up suggests several actions:

• Verify your exact branch and build against the fixed releases named in FG-IR-26-175 rather than trusting the version ranges in the NVD record, which mark the affected builds rather than the safe ones. Jumping from a long-term branch to the newest feature release is a change-control decision, not a patch.
• Remove administrative interfaces from public internet exposure while the upgrade is scheduled. A web console answering on the open internet carried risk before this CVE and carries more now.
• Hunt for evidence of prior use. Searching web server logs for traversal patterns in request paths is a sensible first pass, but an attacker with a working payload would have no reason to repeat the traversal. Compare file modification times across the web root, the cron directories, and startup scripts against a known baseline, and fully review any file created by the web user in a directory where it has no business writing.
• Treat the mail queue's integrity as suspect on any appliance that was exposed, since message contents can no longer be assumed to match what users actually sent.

Why it matters

An unauthenticated write primitive on an internet-facing edge appliance is a materially worse problem than the file-read traversals that dominate advisories, because the outcome depends on attacker creativity rather than on which files happen to sit on disk. The CISA listing turns the patch into urgent cleanup rather than routine maintenance. And the broader observation from the dev.to piece holds beyond FortiMail: edge devices accumulate exposed interfaces over time, often quietly during incidents or support sessions. The flaw itself is Fortinet's to repair; keeping the console off the open internet is the operator's job.