Fortinet FortiMail Path Traversal Vulnerability

CVE-2026-104286 is a path traversal and improper neutralization of NULL byte/character vulnerability affecting Fortinet FortiMail. An unauthenticated attacker can exploit this flaw by sending crafted HTTP or HTTPS requests to write arbitrary files on the underlying system. The vulnerability requires no authentication, making it particularly dangerous. It has been flagged by CISA under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under the BOD 26-04 implementation guidance. Organizations using FortiMail are urged to apply patches immediately. Details are available via Fortinet's PSIRT advisory FG-IR-26-175 and the NVD entry for this CVE.