Most path traversal advisories are read problems: an attacker walks out of a download directory and pulls a configuration file. CVE-2026-104286 in Fortinet FortiMail is not that. The vendor's own wording describes an unauthenticated attacker writing files through crafted HTTP or HTTPS requests, and that single word changes what a mail gateway compromise looks like from the inside.
Fortinet published the defect as FG-IR-26-175 with a CVSS 3.1 base score of 9.8. The affected branches listed in the record are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. CISA added it to the Known Exploited Vulnerabilities catalog on 1 October 2026, three weeks before this article.

Why a mail gateway is a different target

A mail gateway sits at the edge by design. It has an SMTP listener that must accept connections from the internet, a web administration interface, and often a quarantine or message-trace view reachable by helpdesk staff. It also holds the mail queue, which for a corporate tenant means message bodies, headers, attachments, and the envelope metadata that shows who talks to whom.
Writing a file into that system is therefore a bigger step than the CVSS vector alone suggests. The vulnerable component accepts requests without authentication, so the attacker does not need an administrator credential, a session cookie, or a valid mailbox. The advisory does not enumerate which directories the traversal reaches. That omission matters, because the impact of an arbitrary write is entirely a function of where the write lands.

Reading the gap honestly

Fortinet's description states that the flaw may allow writing arbitrary files on the underlying system. It does not state that remote code execution follows. Several public summaries have bridged that gap by implication, and analysts should be careful about repeating the bridge as fact.
What the record supports is narrower and still serious. A write primitive reachable without credentials on an internet-facing appliance can place content in a web-served path, in a directory consumed by a scheduled job, or in a location read by a configuration loader. Whether any of those apply depends on the deployment, the branch, and the file system permissions of the daemon handling the request. Until an advisory or a reproducible public analysis names the reachable paths, treat code execution as a possibility to be tested in your own lab rather than an established outcome.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes full confidentiality, integrity, and availability impact within the appliance's security scope without user interaction. Read that as the vendor's assessment of the appliance, not of your mail flow.

What to do before you finish reading

Confirm your branch and build against the fixed releases named in FG-IR-26-175 rather than against the ranges in the NVD record. The ranges describe what is vulnerable, not what is safe. Appliances that lag several maintenance windows on a long-term branch need the fixed build for that branch, and a jump to the latest feature release is a change-control decision, not a patch.
Reduce the interface surface while you schedule the upgrade. Administrative access to FortiMail has no business answering on the public internet. If the web console is reachable from outside, that exposure carried risk before CVE-2026-104286 and carries more now.
Then look for evidence that someone already used the write path. Web server logs for traversal sequences in request paths are the obvious first pass, but an attacker who reached a working payload would not need to repeat the traversal. Compare file modification times across the web root, the cron directories, and the startup scripts against your known deployment baseline. Any file created by the web user in a directory where the web user has no reason to write is worth a full review.
Message queue integrity deserves the same attention. If an appliance was writable by an unauthenticated party, you cannot assume the queue contents are what your users sent.

The lesson that outlasts this CVE

Edge appliances accumulate interfaces faster than they accumulate review. A mail gateway exposes SMTP to everyone by necessity; it exposes a web console to a much smaller group by policy, and that policy lapses quietly during an incident or a vendor support session. The vulnerability here is the vendor's to fix. The reachability is yours.

References

  • Fortinet PSIRT advisory FG-IR-26-175, https://fortiguard.fortinet.com/psirt/FG-IR-26-175

  • NIST NVD record for CVE-2026-104286, https://nvd.nist.gov/vuln/detail/CVE-2026-104286

  • CISA Known Exploited Vulnerabilities catalog entry, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286