VulnRadar

Data against noise.

Built with NaN
Page generated: 10 Nov 2026, 15:48 UTC
← Dashboard

CVE-2026-104286

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthen…

Read full description
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
1.4/10
REALITY · THREAT PRIORITY
8.5/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 4.57%: +0.02

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 25 documents and public datasets.

Hype components

Headline sample (25%)
30/100
Press, 30 days (60%)
10/100
Grounded branding (15%)
0/100
HYPE TOTAL14/100

Sources and documents

Cyber Kendra
Press · 23 Oct 2026, 01:33 · Fortinet Patches AI-Found Flaws in FortiOS, FortiManager - Cyber Kendra
https://tech-insider.org/
Press · 13 Oct 2026, 07:00 · FortiMail Zero-Day Hits CVSS 9.8, Lands on CISA KEV [2026] - https://tech-insider.org/
The Hacker News
Press · 05 Oct 2026, 07:00 · ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests - The Hacker News
CyberSecurityNews
Press · 05 Oct 2026, 07:00 · Cybersecurity Newsletter Bulletin – Pentagon Data Breach, Citrix, Fortimail and Apple 0-days and 20+ stories - CyberSecurityNews
CyberSecurityNews
Press · 05 Oct 2026, 07:00 · CISA Adds Fortinet FortiMail 0-day Vulnerability to KEV Following Active Exploitation - CyberSecurityNews
See all 25 source documents
SOC Prime
Press · 05 Oct 2026, 07:00 · CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes - SOC Prime
Help Net Security
Press · 04 Oct 2026, 07:00 · Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited - Help Net Security
Rescana
Press · 04 Oct 2026, 07:00 · Active Exploitation Alert: Critical Fortinet FortiMail Zero-Day (CVE-2026-104286) Enables Unauthenticated Arbitrary File Writes - Rescana
Pasquale Pillitteri
Press · 03 Oct 2026, 07:00 · FortiMail Zero-Day Rated 9.8 Already Exploited, Patches Still Pending - Pasquale Pillitteri
https://tech-insider.org/
Press · 03 Oct 2026, 07:00 · FortiMail Zero-Day: CVSS 9.8, 3-Day CISA Deadline [2026] - https://tech-insider.org/
Field Effect
Press · 02 Oct 2026, 19:51 · Patches pending for actively exploited FortiMail flaw - Field Effect
shattered.io
Press · 02 Oct 2026, 14:15 · FortiMail CVE-2026-104286: CVSS 9.8, CISA Alert - shattered.io
CCB Belgium
Press · 02 Oct 2026, 07:00 · Warning: Actively Exploited FortiMail Vulnerability, Patch Immediately! - CCB Belgium
Cybersecurity Dive
Press · 02 Oct 2026, 07:00 · Fortinet warns that critical flaw in FortiMail is facing exploitation - Cybersecurity Dive
The Register
Press · 02 Oct 2026, 07:00 · Fortinet sounds the alarm over actively exploited FortiMail zero-day - The Register
The Hacker News
Press · 02 Oct 2026, 07:00 · Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes - The Hacker News
CyberSecurityNews
Press · 02 Oct 2026, 07:00 · Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks - CyberSecurityNews
SecurityWeek
Press · 02 Oct 2026, 07:00 · Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action - SecurityWeek
Help Net Security
Press · 02 Oct 2026, 07:00 · Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) - Help Net Security
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 02 Oct 2026, 07:00 · Fortinet Products Remote Code Execution Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
Forkast News
Press · 02 Oct 2026, 07:00 · Langflow’s 12th Exploited CVE of 2026 Fuels Sustained Credential Harvesting Campaign - Forkast News
Forkast News
Press · 02 Oct 2026, 07:00 · FortiMail’s Encryption Feature Was Supposed to Protect Email. It Became the Attack Vector. - Forkast News
BleepingComputer
Press · 01 Oct 2026, 07:00 · Fortinet warns of critical FortiMail flaw exploited in zero-day attacks - BleepingComputer
watchTowr
Press · 27 Sep 2026, 01:55 · Progress ShareFile Pre-Auth RCE Chain - watchTowr
watchTowr
Press · 17 Feb 2026, 08:00 · Ivanti EPMM Zero-Days CVE-2026-1281, 1340 - watchTowr

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 3.8Reality 8.503 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 3.1Reality 8.504 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 2.5Reality 8.505 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 1.4Reality 8.5Nov 2Nov 3Nov 4Nov 5

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
ShadowForge-Cyber/CVE-2026-104286-POC00—02 Oct 2026, 05:46
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 4.6%
Attention, last 30 days
2 distinct story titles; 2 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:51.107056+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
17 Feb 2026, 08:00
Added to the CISA KEV catalog
01 Oct 2026, 00:00
Published
01 Oct 2026, 19:17
Latest press mention
23 Oct 2026, 01:33
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
1 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar