Fortinet FortiMail Path Traversal Exploitation (CVE-2026-104286)

let traversalPatterns = dynamic(["../","..%2f","..%5c","%2e%2e%2f","%252e%252e","..\\","%00","%2500","....//"]);
CommonSecurityLog
| where DeviceVendor == "Fortinet" and DeviceProduct has "FortiMail"
| where RequestURL has_any (traversalPatterns) or AdditionalExtensions has_any (traversalPatterns)
| where RequestURL has_any ("/admin", "/api", "/webmail", "/cgi-bin", "/download")
| extend TraversalHit = tostring(RequestURL)
| project TimeGenerated, SourceIP, DestinationIP, DeviceName, RequestURL, RequestMethod, Activity, DeviceAction
| summarize Attempts = count(), URLs = make_set(RequestURL, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceName
| where Attempts >= 1
| order by Attempts desc

index=fortinet (vendor="Fortinet" OR sourcetype="fortinet:fortimail") (uri_path="*../*" OR uri_path="*..%2f*" OR uri_path="*%2e%2e%2f*" OR uri_path="*..%5c*" OR uri="*%00*" OR uri="*....//*")
| search (uri="*/admin*" OR uri="*/api*" OR uri="*/webmail*" OR uri="*/cgi-bin*" OR uri="*/download*")
| stats count AS attempts values(uri) AS uris min(_time) AS first_seen max(_time) AS last_seen by src_ip dest_ip host http_method
| where attempts >= 1
| sort - attempts

network where event.category == "network" and
  (url.original : "*../*" or url.original : "*..%2f*" or url.original : "*%2e%2e%2f*" or url.original : "*..%5c*" or url.original : "*%00*" or url.original : "*....//*") and
  (url.path : "*/admin*" or url.path : "*/api*" or url.path : "*/webmail*" or url.path : "*/cgi-bin*" or url.path : "*/download*") and
  observer.vendor : "Fortinet"

SELECT sourceip, destinationip, "URL" AS url, "Request Method" AS method, COUNT(*) AS attempts, MIN(starttime) AS first_seen, MAX(starttime) AS last_seen FROM events WHERE (LOWER("Device Vendor") = 'fortinet' AND LOWER("Device Product") LIKE '%fortimail%') AND ("URL" ILIKE '%../%' OR "URL" ILIKE '%..%2f%' OR "URL" ILIKE '%%2e%2e%2f%' OR "URL" ILIKE '%..%5c%' OR "URL" ILIKE '%%00%' OR "URL" ILIKE '%....//%') AND ("URL" ILIKE '%/admin%' OR "URL" ILIKE '%/api%' OR "URL" ILIKE '%/webmail%' OR "URL" ILIKE '%/cgi-bin%' OR "URL" ILIKE '%/download%') GROUP BY sourceip, destinationip, url, method ORDER BY attempts DESC LAST 24 HOURS

_sourceCategory=*fortinet* OR _sourceCategory=*fortimail*
| where (url matches "*../*" or url matches "*..%2f*" or url matches "*%2e%2e%2f*" or url matches "*..%5c*" or url matches "*%00*" or url matches "*....//*")
| where (url matches "*/admin*" or url matches "*/api*" or url matches "*/webmail*" or url matches "*/cgi-bin*" or url matches "*/download*")
| count as attempts, min(_messageTime) as first_seen, max(_messageTime) as last_seen by src_ip, dest_ip, url, http_method
| where attempts >= 1
| sort by attempts desc

rule fortimail_cve_2026_104286_path_traversal {
  meta:
    author = "Argus"
    description = "FortiMail path traversal exploitation CVE-2026-104286"
    severity = "CRITICAL"
  events:
    $e.metadata.vendor_name = /Fortinet/ nocase
    $e.target.application = /FortiMail/ nocase
    (
      re.regex($e.network.http.referral_url, `\.\./|\.\.%2f|%2e%2e%2f|\.\.%5c|%00|\.\.\.\.//`) nocase or
      re.regex($e.target.url, `\.\./|\.\.%2f|%2e%2e%2f|\.\.%5c|%00|\.\.\.\.//`) nocase
    )
    re.regex($e.target.url, `/admin|/api|/webmail|/cgi-bin|/download`) nocase
    $src = $e.principal.ip
  match:
    $src over 10m
  condition:
    $e
}

#event_simpleName=NetworkConnect* OR #repo=fortinet
| vendor=/Fortinet/i AND product=/FortiMail/i
| (url=/\.\.\//i OR url=/\.\.%2f/i OR url=/%2e%2e%2f/i OR url=/\.\.%5c/i OR url=/%00/i OR url=/\.\.\.\.\/\//i)
| (url=/\/admin/i OR url=/\/api/i OR url=/\/webmail/i OR url=/\/cgi-bin/i OR url=/\/download/i)
| groupBy([src_ip, dest_ip, url, http_method], function=[count(as=attempts), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(attempts, order=desc)