FortiMail critical flaw exploited before a patch was available (CVE-2026-104286)

On October 1, Fortinet published advisory FG-IR-26-175 about a critical vulnerability in its FortiMail email gateway. Tracked as CVE-2026-104286 and rated 9.8 out of 10 (CVSS), it is already being exploited by attackers. The same day, the US agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.

The vulnerability

It is a path traversal combined with improper handling of the null byte. It allows an unauthenticated attacker to write arbitrary files to the system using crafted HTTP or HTTPS requests. According to watchTowr researchers, this file write is then enough to execute commands on the device. The flaw was discovered by Fortinet's product security team.

Affected versions and patches

• FortiMail 8.0.0 to 8.0.1: fixed in 8.0.2 (release notes published on October 3);
• FortiMail 7.6.0 to 7.6.6: fixed in 7.6.7 (release notes published on October 2);
• FortiMail 7.4.0 to 7.4.8: fixed in 7.4.9 (release notes published on October 3);
• FortiMail 7.2.0 to 7.2.9: no patch planned for this branch; migrate to 7.4.9 or a later version.

Listed as “upcoming” when the advisory was first published, these versions now appear as available following its October 5 update. FortiMail Cloud customers do not need to do anything: Fortinet patched their instances the same day.

What to do now

Install the fixed version for your branch without delay. If you cannot update immediately, Fortinet recommends disabling identity-based encryption (IBE):

config system encryption ibe
    set status disable
end

Otherwise, cut off Internet access to the webmail interface or restrict it to trusted networks, as Fortinet recommends. Behind a web application firewall (WAF), block POST requests to /ibe that contain ../. As a precaution, the administration interface should not be exposed either.

Checking for compromise

Fortinet's advisory and BleepingComputer list several indicators, including:

• the presence of unexpected files such as /data/lib/liblog.so, /data/etc/ld.so.preload, /data/bin/webconsole or /data/bin/mailservice;
• an archive account named archive234 pointing to a remote server, a possible sign of archived email exfiltration;
• connections from the addresses 79.141.169.187 and 45.129.0.192;
• a scheduled task tied to /migadmin, as well as unusual IBE decryption errors.

An email gateway sees all of an organization's communications. If in doubt, treat the device as compromised: preserve the logs and forensic traces, reinstall it and change the associated secrets.