Fortinet Path Traversal Flaws Hit FortiMail and More — Straight Onto CISA KEV
What happened
Fortinet products were hit by path-traversal vulnerabilities that landed quickly on CISA's Known Exploited Vulnerabilities catalog:
- CVE-2026-104286 — affecting FortiMail, added to KEV on October 1, 2026.
- CVE-2025-61624 — affecting multiple Fortinet products, added to KEV on October 16, 2026.
- Apply Fortinet's patched firmware for FortiMail and any other affected products in your estate.
- Restrict administrative and management access to trusted networks — never expose device management to the internet.
- Review device configs and logs for signs of unauthorized file access after exposure.
- Rotate admin credentials and API keys on any device that was exposed and unpatched.
Why it matters
Fortinet gear sits at the heart of many enterprise and service-provider networks — FortiGate firewalls, FortiMail secure email gateways, FortiManager, and more. These devices are internet-facing and trusted to enforce security policy, which makes any traversal bug that exposes files or enables code execution a serious concern.
Fortinet appliances have been a recurring target throughout 2025 and 2026, so defenders should treat new Forti-CVEs as "patch now" by default.
How path traversal hurts
A path traversal (also called directory traversal) flaw lets an attacker step outside the directory an application is supposed to confine them to, using sequences like ../ to reach sensitive files. Depending on the component, that can mean reading configuration and credential files, or writing files to locations that lead to code execution.
How to defend
What it means for you
If you are working through our FortiGate Security and FortiGate Infrastructure (NSE 4) courses, this is your field reminder: the skills you are building — locking down admin access, segmenting management, and staying current on firmware — are exactly what stops bugs like these from becoming breaches. Fortinet appliances are powerful, but they demand disciplined patching.