Fortinet FortiMail Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 01/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| fortimail | ≥ 7.0.0, ≤ 7.0.9≥ 7.2.0, ≤ 7.2.9≥ 7.4.0, < 7.4.9≥ 7.6.0, < 7.6.7≥ 8.0.0, < 8.0.2 | 7.4.97.6.78.0.2 |
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free