Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Fortinet revises FortiMail path-traversal advisory FG-IR-26-199

1 source · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Fortinet revised an unauthenticated FortiMail path-traversal advisory scored CVSS 9.8; versions and exploitation are unlisted.

Fortinet revised advisory FG-IR-26-199 on November 10, 2026. It describes a CWE-22 path-traversal vulnerability in FortiMail. An unauthenticated attacker may execute unauthorized code or commands through crafted requests. Fortinet assigns a CVSSv3 score of 9.8. The published snippet lists no affected versions, fixed release, or confirmed attacks.

Key facts
  • Advisory identifier is FG-IR-26-199.
  • Weakness class is CWE-22 path traversal.
  • Only FortiMail is named as affected.
  • The attacker does not need to authenticate.
  • Fortinet scores the issue CVSSv3 9.8.
  • No versions, fix, or confirmed attacks are listed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026Fortinet revised advisory FG-IR-26-199 · Fortinet PSIRT

What each outlet adds

beyond the shared facts
  • Fortinet PSIRTNames FG-IR-26-199, FortiMail, CWE-22, and CVSS 9.8.
Vendors
Fortinet
Products
FortiMailFortiMai

Coverage

oldest first · one row per article · UTC
  1. · 20h ago Fortinet PSIRTFirst report

    Unauthenticated FortiMai path traversal may allow command execution

    Fortinet scores the issue CVSS 7.5; the November 10 revision does not list versions or attacks.

  2. · 20h ago Fortinet PSIRT

    Unauthenticated FortiMail path traversal can execute code, CVSS 9.8

    FG-IR-26-199 is a CWE-22 flaw; the snippet gives no versions, patch or exploitation status.