Is CVE-2026-104286 (Fortinet FortiMail Path Traversal) being exploited in the wild?

Yes. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalogue on 1 October 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

What the KEV listing means for this FortiMail issue

CISA placing CVE-2026-104286 in KEV is the clearest operational signal that the flaw has moved beyond theoretical exposure. For FortiMail, that means practitioners should treat it as an active exploitation problem, not a routine vulnerability backlog item, and verify whether any internet-facing mail security instance is within scope.

The bug description matters because it points to a file-write path rather than a narrow crash condition. An unauthenticated attacker who can send crafted HTTP or HTTPS requests may be able to write arbitrary files on the underlying system, so exposure assessment should include the management and web-request surface, not only mail-flow features.

For teams handling edge appliances, the security question is often not whether the product is deployed, but whether the vulnerable request path is reachable from a trusted or semi-trusted network segment. NHIMG’s Edge Device Security Guide is useful here because appliance exposure, logging minimums and patch planning become the real control problem once a device is publicly reachable.

Why path traversal on a mail appliance is dangerous

Path traversal combined with improper null-byte neutralization can be more than a file disclosure issue. If an attacker can influence where the server writes content, they may plant a file, alter configuration, or create a foothold for later execution depending on the appliance layout, filesystem permissions and downstream services.

That is why this class of flaw often becomes an incident-response issue even when the original advisory only describes file write. On a security appliance, the impact can spread into message handling, admin access, local persistence and possibly adjacent systems that trust the appliance for filtering or routing decisions.

General vulnerability triage also matters because active exploitation changes the priority order. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide both reinforce the same point: once exploitation is confirmed, KEV status and exposure window outrank abstract severity scoring.

What practitioners should do before and after patching

First confirm whether the FortiMail instance is reachable through the vulnerable request path and whether any compensating control truly blocks that traffic. If patching or vendor remediation cannot happen immediately, reduce exposure by restricting access to the management and web interface, tightening allowlists, and preserving logs that can show suspicious request patterns.

Then look for signs of pre-patch compromise. Because the flaw may allow arbitrary file writes, review for unexpected new files, modified web content, strange configuration changes, or unapproved scheduled tasks and scripts. If the appliance stores credentials, keys, or session material locally, assume they may need rotation after remediation.

When you need a breach-oriented view of what file-write exploitation can lead to, NHIMG’s Gladinet Hard-Coded Keys RCE Exploitation and Web Application Attacks Guide help connect request handling flaws to real attacker outcomes, including persistence and later-stage execution paths.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed appliance flaws require rapid exposure assessment and remediation prioritisation.
Recommendation — Prioritise and remediate KEV-listed FortiMail exposure immediately.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Actively exploited vulnerabilities should be triaged as an enterprise risk decision, not a routine backlog item.
Recommendation — Escalate KEV-listed exposure through your risk decision process.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Finding exposed FortiMail instances and validating remediation depends on ongoing vulnerability monitoring.
Recommendation — Scan for FortiMail exposure and verify remediation results.
OWASP ASVS	V8 — Authorization	Path traversal and arbitrary file write risks reflect broken request authorization and path handling in web-exposed services.
Recommendation — Validate request handling paths that should never permit arbitrary file writes.
OWASP API Security Top 10	API8 — Security Misconfiguration	Web-request exposure on FortiMail can be amplified by insecure appliance configuration and reachability.
Recommendation — Harden exposed FortiMail interfaces and remove unnecessary access paths.

Practitioner Guidance

What to prioritise: Treat KEV-listed appliance flaws as exposure reduction work first, not as a deferred patch ticket. If FortiMail is internet-facing or reachable by broadly trusted internal users, assume the blast radius is high until proven otherwise.

What to verify: Confirm whether the vulnerable request path is reachable, whether the device has been modified, and whether logs cover the timeframe before remediation. If the appliance cannot prove integrity, plan for compromise assessment rather than only patch validation.

Decision rule: If you cannot patch immediately, reduce reachability and monitor for file-write artifacts, then escalate to credential, session and key review when the device has any authority beyond simple filtering.

Practitioner takeaway: For KEV-listed perimeter appliances, the question is not just whether the vendor has a fix, but whether the device has already been used as an entry point or persistence layer.