Fortinet FortiMail Flaw Exploited to Write Arbitrary Files

TL;DR

• A critical path traversal vulnerability in Fortinet FortiMail allows unauthenticated attackers to write arbitrary files on target systems [^1].
• CISA added the flaw to its active exploit catalog, warning organizations that threat actors are actively exploiting it in the wild [^2].

Background

Fortinet FortiMail is a specialized email security gateway designed to protect organizations from inbound email threats like spam, phishing, and malware. Because these gateways sit at the perimeter of an enterprise network, they must process large volumes of untrusted data from the open internet. To allow administrators and users to manage quarantine folders and adjust settings, these appliances run web servers hosting administrative portals and webmail interfaces. This exposed web interface makes them prime targets for external attackers looking to bypass perimeter defenses.

What happened

On October 1, 2026, details emerged regarding a critical vulnerability in Fortinet FortiMail, tracked as CVE-2026-104286 [^1]. The security flaw consists of a path traversal vulnerability combined with the improper neutralization of a null byte or null character [^1]. This combination allows an unauthenticated, remote attacker to write arbitrary files onto the underlying operating system of the appliance by sending specially crafted HTTP or HTTPS requests to the exposed web interface [^1].

Path traversal occurs when an application accepts input from a user and uses it to construct a file path without sufficient validation. By using directory traversal sequences like ../, an attacker can escape the intended folder structure and access or write to restricted system directories. In this case, the risk is amplified by the presence of a null byte vulnerability. Historically, many systems written in languages like C or C++ use a null character to mark the end of a string. When the FortiMail backend processes a filename containing a null byte, the system truncates the string at that character. This allows an attacker to bypass file extension checks, tricking the application into validating one file type while the underlying operating system writes another.

The Cybersecurity and Infrastructure Security Agency (CISA) responded swiftly by adding CVE-2026-104286 to its Known Exploited Vulnerabilities catalog [^2]. This action confirms that threat actors are actively exploiting this vulnerability in the wild [^2]. Because the exploit does not require any user interaction or authentication, attackers can scan the internet for unpatched FortiMail gateways and compromise them silently. Fortinet has released security updates to address the flaw, urging system administrators to apply the patches immediately to prevent unauthorized access.

Why it matters

The active exploitation of CVE-2026-104286 highlights a persistent vulnerability class in enterprise security appliances. Email gateways are highly trusted systems within corporate networks. They hold directory credentials, route confidential communications, and often possess broad access to internal segments to deliver mail. If an attacker compromises an email gateway, they gain a powerful foothold. From this position, they can monitor sensitive corporate communications, launch internal phishing campaigns that appear highly credible, or pivot to other high-value targets inside the network.

This specific vulnerability also underscores the dangers of legacy architectural issues in security software. Null byte injection is a classic web application vulnerability that security engineers have understood for decades. Its occurrence in modern enterprise appliances indicates that legacy codebases or third-party libraries continue to introduce structural risks. When security products themselves become the entry point for network intrusions, it complicates the defense strategy for enterprise IT teams.

Furthermore, the speed with which threat actors weaponize these flaws highlights the necessity of rapid patch management. For edge devices like FortiMail, the window of time between the disclosure of a vulnerability and active exploitation is shrinking. Organizations cannot rely on weekly or monthly patch cycles for edge-facing security appliances. Instead, they must establish automated monitoring and rapid-deployment pipelines to apply critical security updates as soon as they are published by vendors.

Practical example

Imagine a remote attacker targeting an unpatched FortiMail gateway at a mid-sized firm. The attacker sends a crafted HTTP POST request to the gateway's webmail attachment endpoint. The request includes a payload designed to write a malicious script.

The attacker names the file backdoor.php%00.jpg. The gateway's security filter inspects the request, sees the .jpg extension, and approves the upload as a benign image. However, when the application passes the file name to the underlying operating system to write the file to disk, the C-based function reads the name. It encounters the %00 null byte and stops reading.

The operating system writes the file to the web root directory as backdoor.php. The attacker then navigates to the file's URL in a browser, executing the script and gaining full control over the email gateway.

Related gear

We recommend this guide because it provides clear, step-by-step explanations of directory traversal and input validation vulnerabilities, helping you understand how attackers exploit flaws like the one found in FortiMail.