FortiMail Path Traversal – CVE-2026-104286

Customers with an Managed Services contract for their FortiMail environment: we follow the agreed service delivery to assess and proactively implement the necessary measures. If in doubt, feel free to check with your regular contact for what has been planned or implemented for your environment.

If you want to get started yourself, here are the steps:

FortiMail – CVE-2026-104286

FortiMail 8.0 8.0.0 – 8.0.1 > Upgrade to 8.0.2 or higher (when available)
FortiMail 7.6 7.6.0 – 7.6.6 Upgrade to 7.6.7 or higher (when available)
FortiMail 7.4 7.4.0 – 7.4.8 Upgrade to 7.4.9 or higher (when available)
FortiMail 7.2 7.2.0 – 7.2.9 > Upgrade to branch 7.4 or higher

Attention: The patched versions have not yet been released Fortinet at this time. recommends Fortinet that The workaround is already in place To apply: disable the IBE function via the GUI (Encryption > IBE > IBE Service ‘off’) or via the CLI:

config system encryption ibe
Set status disabled
end

If that’s not possible, then block access to the FortiMail management interface from the internet or limit it to trusted private networks.

Install the patch as soon as possible after Fortinet it is released. The available versions can be found in the PSIRT advisory (Fortinet see source).

Have you No Managed Services contract, or do you want VanRoey to support you? Contact us to have this resolved for you. This can be done via email at support@vanroey.be (mention your FortiMail version) or call: 014 470 605. You can also create a ticket.