[CVE-2026-104286] Fortinet FortiMail — Fortinet FortiMail Path Traversal Vulnerability

What happened?

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

Key details

• Linux Kernel has an out-of-bounds write flaw in the ebtables SNAT target.
• An ARP sender hardware address rewrite can write into a nonlinear socket-buffer fragment.
• The vulnerable buffer is backed by a splice-imported file page.
• The impacted product may be end-of-life or end-of-service.
• Users should discontinue use or move to a supported version.
• Forensic triage is required under BOD 26-04.

Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.