CVE-2026-104286

Summary

This vulnerability allows an unauthenticated attacker to write arbitrary files on the system by exploiting path traversal in FortiMail versions 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9, enabling unauthorized code execution.

Exploitability

Exploitation is relatively straightforward as it requires crafting HTTP or HTTPS requests to a specific endpoint, which may be accessible to external attackers.

Blast radius

If exploited, this vulnerability could lead to unauthorized code execution, potentially allowing the attacker to gain full control over the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FortiMail 8.0.2 or later, 7.6.7 or later, 7.4.9 or later, or 7.2.10 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.