EUVD-2026-91042
GHSA-6gxc-3vv7-7w24
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote HTTP request (AV:N/AC:L/PR:N/UI:N); arbitrary file write enables code execution giving full CIA impact (C:H/I:H/A:H).
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
5DescriptionCVE.org
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Articles & Coverage 2
AnalysisAI
Unauthenticated path traversal in Fortinet FortiMail (7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6 and 8.0.0-8.0.1) lets a remote attacker write arbitrary files on the underlying system via crafted HTTP or HTTPS requests, yielding CVSS 9.8 with full confidentiality, integrity and availability impact. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, so it is confirmed actively exploited (CISA KEV), and publicly available exploit code exists, making unpatched internet-reachable gateways an urgent remediation priority. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special product-feature prerequisites are stated in the description: exploitation requires only that the FortiMail HTTP/HTTPS interface be network-reachable, with no authentication (PR:N) and no user interaction (UI:N), against affected versions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Fortinet has published a PSIRT advisory for this issue (FG-IR-26-175, https://fortiguard.fortinet.com/psirt/FG-IR-26-175), which is the authoritative source for the exact fixed release in each branch - the provided data does not enumerate a specific patched version, so patch available per vendor advisory, and administrators should upgrade every affected FortiMail instance (7.2.x, 7.4.x, 7.6.x and 8.0.x branches, and any 7.0.x build if EUVD's wider range is confirmed) to the latest vendor-specified fixed build in that branch rather than assuming boundary releases are clean. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Fortinet FortiMail instances, prioritizing releases 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1; immediately remove internet exposure of the FortiMail HTTP/HTTPS interface by restricting access to trusted management networks or VPN, blocking inbound TCP 80/443 from untrusted sources, and applying deny-by-default firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 an
An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wil
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.
Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow
Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMai
An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 throu
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 thr
An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of Fo
Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail befo
An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engin
Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMai
A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiAD
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today