Fortinet FortiMail is affected by a critical vulnerability CVE-2026-104286 (CVSS 9.8) that allows a remote unauthenticated attacker to write arbitrary files to the system over HTTP(S). The vendor confirms exploitation “in the wild” and recommends immediately applying the workarounds from advisory FG-IR-26-175, and CISA has added this flaw to the Known Exploited Vulnerabilities catalog and requires federal agencies to take protective actions by 4 October 2026.
Technical details of vulnerability CVE-2026-104286
According to Fortinet advisory FG-IR-26-175, the vulnerability is classified as:
- CVE: CVE-2026-104286
- Score: CVSSv3 9.8 (critical)
- Type: Improper limitation of a pathname to a restricted directory (path traversal, CWE-22) and Improper neutralization of NULL byte/character (CWE-158)
- Vector: remote access over HTTP or HTTPS without authentication
- Main impact: ability to write arbitrary files to the device’s file system
Fortinet describes the issue as a combination of:
- path traversal — insufficient filtering of the file path, which allows escaping the expected directories;
- improper neutralization of the NULL byte — which is typically used to bypass extension checks or truncate strings when working with server-side file functions.
Exploitation is carried out via specially crafted HTTP/HTTPS requests to FortiMail. Since the vulnerability is triggered before the authentication stage, it is enough for the attacker to have network access to the interface to attempt to write their own files into sensitive areas of the file system. From the perspective of the ATT&CK matrix this falls under the Initial Access tactic and the technique of writing files for subsequent execution, but it is more accurate not to pin down a specific technique here, as the vendor does not disclose the scenario up to code execution.
Affected FortiMail versions
The following FortiMail branches and versions are affected:
- FortiMail 8.0.0–8.0.1 (it is recommended to update to 8.0.2 or higher when it becomes available)
- FortiMail 7.6.0–7.6.6 (update to 7.6.7 or higher)
- FortiMail 7.4.0–7.4.8 (update to 7.4.9 or higher)
- FortiMail 7.2.0–7.2.9 (migrate to branch 7.4 or higher)
A standard entry in the NVD database is expected for this vulnerability; it will be available at NVD: CVE-2026-104286, where additional details of the vector and CVSS subcomponents will be published over time.
Confirmed exploitation and indicators of compromise
Fortinet explicitly states that the vulnerability is already being used in targeted attacks. The advisory publishes specific indicators of compromise (IOCs) that can help with retrospective analysis:
Hostile IP addresses:
- 79.141.169[.]187
- 45.129.0[.]192
Suspicious files and changes on FortiMail:
- /data/lib/liblog.so (added)
- /data/bin/webconsole (added)
- /data/bin/mailservice (added)
- /data/etc/ld.so.preload (added)
- /bin/smit (modified)
- /data/etc/httpd.conf (modified)
- /data/migadmin.tar.gz (modified)
The set of paths gives an indirect understanding of the nature of the attack: modification of ld.so.preload and system binaries points to an attempt to establish persistence via library hooking and altering the behavior of system components, while changes to the httpd configuration and adding custom binaries under /data/bin look like deployment of a persistent web-based management interface and a backdoor.
Context and threat nature for mail infrastructure
The fact that CVE-2026-104286 is included in the CISA Known Exploited Vulnerabilities catalog and the requirement from CISA’s alert on adding a new vulnerability for U.S. federal civilian agencies to act by 4 October 2026 underlines that this is not a theoretical risk, but an ongoing exploitation campaign.
The broader background is also worth noting: at the same time, according to CISA, vulnerabilities in Check Point, Arista, F5, Cisco and Citrix are being exploited. This paints a typical picture for threat actors targeting network and application gateways: they systematically work through fresh vulnerabilities in perimeter devices that handle key communications (email, VPN, proxies, SD-WAN, load balancers). FortiMail, as a corporate email gateway, in this chain provides:
- access to email flows and content;
- a point for introducing phishing and intercepting correspondence;
- a potential foothold for further developing the attack deeper into the network.
Arbitrary file write without authentication can almost always be turned into code execution on the device (for example, by tampering with the web server configuration, dynamic library loading, or migration and backup mechanisms). This makes CVE-2026-104286 in practical terms equivalent to a FortiMail remote takeover vulnerability when an exploit is available.
Impact assessment for organizations
The highest risk is for organizations where FortiMail is exposed to the internet and runs vulnerable branches 7.2, 7.4, 7.6 and 8.0 without current patches and without the described workarounds.
Critical consequences in the absence of response may include:
- Compromise of the mail infrastructure. Potential unauthorized access to inbound and outbound correspondence, forwarding of email copies, and covert modification of routing.
- Distribution of phishing and malicious attachments from legitimate domains. Compromising FortiMail allows the attacker to send emails from the organization’s trusted domain zone, which sharply increases the success rate of attacks on customers and partners.
- Foothold for further intrusion. Once code execution on FortiMail is achieved, the attacker can use it as an entry point for reconnaissance of the internal network, movement within it, and attacks on other systems.
- Violation of service integrity and availability. Changes to critical files (httpd.conf, system binaries, libraries) can lead both to stealthy traffic modifications and to service outages resulting from configuration errors or removal of system components.
- Regulatory and legal risks. For sectors with strict communication protection requirements (financial sector, public sector, healthcare), the fact that the mail gateway is compromised may be treated as a confidentiality breach incident.
The risk is especially high for:
- organizations with global mail infrastructures and publicly accessible FortiMail management interfaces;
- federal and regional government bodies (given CISA’s separate directive);
- critical infrastructure where email is used as a control channel and for exchanging sensitive documents.
Practical recommendations for protecting FortiMail
1. Immediate actions to reduce risk
Until FortiMail is fully updated, the following measures recommended by Fortinet in the official advisory should be implemented:
- Disable the IBE (Identity Based Encryption) feature.
In the FortiMail CLI, run:config system encryption ibe set status disable endThis is a temporary measure that reduces the attack surface while patches are not yet available for some branches.
- Restrict access to the FortiMail management interface.
- block access to the administrative web interface from the internet;
- allow management only from trusted internal addresses or via jump hosts and VPN;
- make sure firewall policies and routing do not allow these restrictions to be bypassed.
2. Version updates and patch planning
After applying urgent measures, you should plan and carry out updates:
- branch 8.0: update to 8.0.2 or later (as soon as the release becomes available);
- branch 7.6: update to 7.6.7 or later;
- branch 7.4: update to 7.4.9 or later;
- branch 7.2: migrate to 7.4 or a newer branch.
Organizations in the U.S. federal civilian sector should take into account the deadlines from CISA’s KEV update alert and bring FortiMail into compliance (patch or workarounds) no later than the specified date.
3. Searching for compromise traces and monitoring
In parallel with updating, it is worth conducting a targeted security check of FortiMail:
- Check for the presence and state of the following files:
- /data/lib/liblog.so
- /data/bin/webconsole
- /data/bin/mailservice
- /data/etc/ld.so.preload
- /bin/smit
- /data/etc/httpd.conf
- /data/migadmin.tar.gz
Any discrepancies with a baseline installation or unexpected changes to timestamps require in-depth analysis.
- Check logs for access from the IP addresses:
- 79.141.169[.]187
- 45.129.0[.]192
It is important to analyze both administrative sessions and any unusual HTTP requests to the web interface.
- Review logs for unusual requests with long paths, ../ sequences, and suspicious parameters, especially those targeting IBE components or file operations.
- Check whether mail routing policies, address rewriting rules, and integrations with external systems (SIEM, archiving, DLP) have been changed.
If signs of compromise are found, the device should be treated as potentially fully compromised: a separate incident response and forensics effort is required, along with certificate re-issuance and possibly reinstalling FortiMail followed by restoration from a trusted backup.
The key actions for the coming days are to immediately disable IBE on vulnerable FortiMail instances, close access to the management interface from the internet, then update the firmware to safe versions and perform checks using the published IOCs. Ignoring CVE-2026-104286 given its current KEV status effectively means accepting the risk of complete takeover of the mail gateway.
