CISAAnalysisCISA adds Fortinet FortiMail path traversal zero-day to KEV catalog
What happened.CISA added an actively exploited path traversal and arbitrary file write zero-day in Fortinet FortiMail secure email gateways to its Known Exploited Vulnerabilities catalog.
Why it matters.Secure email gateways operate on external network edges to filter incoming corporate communications. When attackers gain unauthenticated remote code execution on an edge mail gateway, they obtain initial network footholds and inspect confidential message traffic. Infrastructure engineers must apply maintenance builds immediately and audit access logs for anomalous requests to the encryption service.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-104286 and advisory FG-IR-26-175 with a 9.8 CVSS score, improper neutralization of null byte sequences in the identity-based encryption service enables path traversal.
- Exploitation path: Unauthenticated remote attackers send crafted HTTP requests to the email gateway to write arbitrary system files and execute code with operating system privileges.
- Remediation releases: Fortinet published maintenance updates across FortiMail version branches 7.2 through 8.0, and advised administrators to disable the encryption service if patching is delayed.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: