FortiMail Zero-Day CVE-2026-104286 Under Attack — Patch Now

Fortinet confirmed on October 1 that a critical, actively exploited vulnerability in FortiMail — tracked as CVE-2026-104286 with a CVSS score of 9.8 — lets an unauthenticated attacker write arbitrary files to the underlying system through a crafted HTTP or HTTPS request. There's no patch for most affected versions yet, and CISA added it to the Known Exploited Vulnerabilities catalog the same day, giving federal agencies until October 4 to mitigate. If you're running FortiMail anywhere in your infrastructure, this is worth stopping to check today.

Key Takeaways

• CVE-2026-104286 is a path traversal plus NULL-byte handling flaw (CVSS 9.8) in FortiMail's management interface that lets an unauthenticated attacker write arbitrary files to the system
• It affects FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1, and Fortinet confirms it's already being exploited in the wild
• Only 7.2 users have a real fix available right now (upgrade to 7.4 or later); patched builds for 7.4, 7.6, and 8.0 are still listed as upcoming
• Until a patch lands, Fortinet's workaround is disabling the IBE (Identity-Based Encryption) feature, or restricting management interface access to trusted networks
• CISA added it to the KEV catalog on October 1 and gave federal agencies a three-day window, to October 4, to mitigate under Binding Operational Directive 26-04

What exactly is CVE-2026-104286?

Fortinet's advisory describes the bug as a combination of two issues: an improper limitation of a pathname to a restricted directory (path traversal, CWE-22) and improper neutralization of NULL bytes (CWE-158). Together, they let an attacker with network access to FortiMail's management interface write arbitrary files to the underlying filesystem using a specially crafted HTTP or HTTPS request — no authentication required. Fortinet's own product security team found the bug internally, credited to Gwendal Guégniaud, but the company has also confirmed it's being actively exploited, which is why it landed directly on CISA's Known Exploited Vulnerabilities list rather than going through a normal disclosure cycle.

Which versions are affected, and is there a patch?

The flaw hits four branches: FortiMail 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. If you're on 7.2, the fix is straightforward — upgrade to 7.4 or later. Everyone else is stuck waiting: Fortinet lists 7.4.9, 7.6.7, and 8.0.2 as the versions that will contain the fix, but none of them were available as of the advisory. That's an unusual position for a vulnerability already rated as under active exploitation, and it's exactly why CISA moved so fast on the KEV listing.

How do you mitigate it right now?

With no patch available for most branches, Fortinet's advisory points to two workarounds. The first is disabling IBE support entirely, since the vulnerable component sits in the IBE GUI:

config system encryption ibe
set status disable
end

The second, if you need IBE, is restricting access to the FortiMail management interface so it's only reachable from trusted internal networks rather than the public internet. Either one buys you time until the real patch ships.

How do you know if you've already been hit?

Fortinet published indicators of compromise alongside the advisory, including several files that show up on compromised systems — among them /data/lib/liblog.so, /data/bin/webconsole, and /data/etc/ld.so.preload, each added or modified with specific SHA-256 hashes listed in the advisory. Two IP addresses tied to the attacks are also in the IOC list, and log entries show attackers configuring an archive account to forward mail data to one of those IPs. If you run FortiMail, checking for those files and connections against your own logs is the fastest way to find out whether you're already compromised rather than just exposed.

Why does this matter beyond another Fortinet CVE?

This isn't Fortinet's first FortiMail vulnerability tied to the IBE subsystem — a similar class of bug hit the product in 2021 and again in 2023, both of which also ended up on CISA's KEV list. It also isn't the first internet-facing security appliance to land in this exact spot this year — we covered the same pattern of Check Point's VPN zero-days under CISA pressure last month. Email security gateways are a uniquely bad spot for this kind of flaw: they're internet-facing by design, they process every inbound message for an organization, and unauthenticated file-write access on one gives an attacker a foothold that's hard to fully account for without forensic review. If FortiMail is part of your stack, the mitigation matters more right now than waiting on the patch timeline.

Wrapping Up

If you're running FortiMail 7.4, 7.6, or 8.0, disable IBE or lock down management interface access today — there's no patch to fall back on yet. 7.2 users should just upgrade. Either way, check your logs against Fortinet's published indicators before assuming you're only exposed and not already compromised.

Sources

BleepingComputer — Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Fortinet PSIRT Advisory FG-IR-26-175