Cyber Centre Daily Advisory Digest — 2026-10-02 (1 advisories)
CVE-2026-104286 is a path traversal vulnerability in Fortinet FortiMail, actively exploited in the wild and added to CISA's KEV catalog. FortiMail versions across branches 7.2 through 8.0 are vulnerable to CVE-2026-104286, a path traversal flaw. CISA confirmed active exploitation and added it to the KEV database on October 1, 2026.
Detection / Hunteropenrouter
Immediate Actions
- Patch FortiMail to 8.0.2, 7.6.7, or 7.4.9 immediately
- Upgrade FortiMail 7.2 installations to branch 7.4 or above
- Restrict network access to FortiMail management interfaces
Key Takeaways
- CVE-2026-104286 affects FortiMail 7.2, 7.4, 7.6, and 8.0 branches
- CISA added CVE-2026-104286 to KEV on October 1, 2026
- Vulnerability type is path traversal — improper pathname limitation to restricted directory
- FortiMail 7.2 users must upgrade to branch 7.4 or above
- Fixed versions: 8.0.2, 7.6.7, and 7.4.9
Attack Chain
- Initial Access: Attacker exploits CVE-2026-104286 path traversal against exposed FortiMail appliance
- Exploitation: Path traversal grants access to files in restricted directories on the FortiMail system
Affected Systems
- FortiMail 8.0 prior to 8.0.2
- FortiMail 7.6 prior to 7.6.7
- FortiMail 7.4 prior to 7.4.9
- FortiMail 7.2 (upgrade to 7.4 or above)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-104286 | Fortinet FortiMail | Path traversal allows access to restricted directories; exploited in the wild. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | FortiMail is a network appliance; EDR agents typically do not run on it. |
| Network Visibility | Medium | HTTP traffic to FortiMail may reveal path traversal exploitation attempts. |
| Detection Difficulty | Moderate | Requires appliance-specific logs and knowledge of path traversal payload patterns. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| HTTP requests to FortiMail containing path traversal sequences like ../ or encoded equivalents indicate exploitation of CVE-2026-104286 (T1190). | FortiMail HTTP request logs, WAF logs | Initial Access | Low — path traversal in FortiMail requests is abnormal |
Required Log Sources
- FortiMail appliance logs
- Network firewall logs
- Reverse proxy logs
- Web application firewall logs
Key Behavioral Indicators
- Path traversal sequences in FortiMail HTTP requests
- Unexpected file access patterns in FortiMail audit logs
- Anomalous HTTP requests to FortiMail web interface
Control Gaps
- EDR does not cover FortiMail network appliances
- WAF may not inspect FortiMail management traffic
- Network IDS signatures for CVE-2026-104286 may not exist yet
False Positive Assessment
Low — specific CVE with known affected versions and clear patch targets.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block external access to FortiMail web management interface
- Deploy WAF rules to detect path traversal in FortiMail traffic
- Monitor FortiMail logs for path traversal exploitation indicators
User Protection
- Verify email security gateway is running patched FortiMail version
- Audit FortiMail deployments for exposed management interfaces
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
A security flaw in Fortinet's FortiMail email security product lets attackers access files they should not be able to reach. Attackers are already exploiting this flaw in the real world, and the US government has added it to a list of vulnerabilities that must be fixed urgently. Organizations using FortiMail should update to the latest patched versions immediately.
- cveCVE-2026-104286Path traversal allows access to restricted directories; exploited in the wild.