Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation

Vulnerability details

CVE	CVSS (Fortinet, v3.1)	KEV	Fixed in
CVE-2026-104286	9.8 (Critical)	✅ added 1 October 2026, due 4 October	7.4.9, 7.6.7, 8.0.2; 7.2 users must move to 7.4 or later

FortiMail zero-day CVE-2026-104286 is under attack

Fortinet has disclosed a critical vulnerability in FortiMail, its email security gateway, that is being exploited in the wild. Tracked as CVE-2026-104286, it combines a path traversal flaw (CWE-22) with improper neutralisation of NULL bytes (CWE-158), and "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests". Fortinet lists the impact as execution of unauthorised code or commands.

Fortinet published advisory FG-IR-26-175 on 1 October 2026 and rates the flaw 9.8 under CVSS v3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was found internally by Gwendal Guégniaud of Fortinet's Product Security team. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog the same day and gave US federal civilian agencies until 4 October 2026 to address it.

Fortinet has not said when or where the attacks were spotted, how many systems were compromised, or who is behind them.

Affected and fixed versions

Branch	Affected	Fix
FortiMail 8.0	8.0.0 to 8.0.1	8.0.2 or later
FortiMail 7.6	7.6.0 to 7.6.6	7.6.7 or later
FortiMail 7.4	7.4.0 to 7.4.8	7.4.9 or later
FortiMail 7.2	7.2.0 to 7.2.9	Move to the 7.4 branch or later

When the advisory was first published the fixed builds had not been released. Fortinet updated the solution on 5 October, and Brandefense reports that fixed releases for the 7.4, 7.6 and 8.0 branches are now available. Fortinet says FortiMail Cloud was fixed on 5 October and Cloud customers need take no action. Note that moving from 7.2 to an affected 7.4 build does not fix the flaw; 7.2 users need 7.4.9 or later.

How the unauthenticated file write works

According to Fortinet and Brandefense, the flaw sits in the request handler for Identity-Based Encryption (IBE), FortiMail's feature for sending encrypted email to recipients without pre-installed certificates. A crafted request can use path traversal sequences to escape the intended directory, while a NULL byte truncates the file name before it reaches the filesystem, letting an unauthenticated attacker write a file to an arbitrary path on the appliance. No session or credentials are needed.

Indicators of compromise

Fortinet's advisory lists two IP addresses, 79.141.169.187 and 45.129.0.192, and log entries to look for, including:

• a cron entry running /bin/sh -c 'O=/migadmin ... as root;
• a CLI configuration event adding an archive account named archive234 that sends data to 79.141.169.187;
• an IBE decrypter BufferException(2) for "Invalid Base64 Encoding" in the encryption logs.

Brandefense lists file-level indicators: a replaced logging library at /data/lib/liblog.so, a modified /bin/smit, a replaced /data/bin/mailservice, a non-standard /data/bin/webconsole, and any file at /data/etc/ld.so.preload, which should not exist on a clean installation. Because the logging library may have been replaced, Brandefense advises relying on external evidence such as firewall and NetFlow logs, for example outbound connections to the two IP addresses above, rather than on the appliance's own logs alone.

Workarounds

If patching is not yet possible, Fortinet's advisory gives these workarounds:

• Disable IBE in the GUI (Encryption > IBE, IBE Service off) or with the CLI: config system encryption ibe, set status disable, end.
• Block internet access to the affected interface, or restrict it to trusted private networks.
• Where a web application firewall sits in front of FortiMail, block POST requests to /ibe containing ../.

Administrators should check for the indicators above before and after upgrading, since installing a fixed build does not show whether the appliance was compromised beforehand.

Key points

• An unauthenticated attacker can write arbitrary files via crafted HTTP or HTTPS requests to FortiMail's IBE request handler.
• Affects FortiMail 7.2.0 to 7.2.9, 7.4.0 to 7.4.8, 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1; fixed in 7.4.9, 7.6.7 and 8.0.2.
• Fortinet rates it CVSS 9.8 (v3.1) and says it has been exploited in the wild.
• CISA added it to KEV on 1 October 2026, with a 4 October deadline for federal civilian agencies.
• Workarounds: disable IBE, restrict access to trusted networks, or block POST requests to /ibe containing ../ at a WAF.

Further reading & sources

• FG-IR-26-175: FortiMail path traversal (CVE-2026-104286) (Fortinet PSIRT)
• Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) (Help Net Security)
• FortiMail Zero-Day CVE-2026-104286 Is Under Attack With No Patch Yet (International Business Times Singapore)
• CVE-2026-104286: FortiMail Zero-Day Arbitrary File Write (BRANDEFENSE Blog)