Fortinet disclosed on October 1, 2026, that a critical vulnerability in FortiMail, its email security appliance, has been exploited in the wild. The flaw, tracked as CVE-2026-104286, lets an unauthenticated attacker write arbitrary files on an affected device by sending crafted HTTP or HTTPS requests. The vendor's advisory, FG-IR-26-175, states: "This has been reported to be exploited in the wild, customers are urged to apply the workaround below."

The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day. It gave Federal Civilian Executive Branch (FCEB) agencies until October 4, 2026, to act, three days after the listing. That deadline passed 15 days ago. CISA's required action is to apply mitigations in accordance with vendor instructions while complying with Binding Operational Directive (BOD) 26-04 and CISA's forensics triage requirements, or to discontinue use of the product if mitigations are unavailable.

The flaw

Fortinet classifies the bug as a path traversal weakness (CWE-22) combined with improper neutralization of a NULL byte or NULL character (CWE-158). The company rates it 9.8 under CVSSv3, with a temporal score of 8.8, and lists the impact as execution of unauthorized code or commands. According to the NVD description, the vulnerability "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests." The CVSS vector requires no privileges and no user interaction.

Fortinet credits Gwendal Guégniaud of its Product Security team with discovering and reporting the flaw internally. According to Help Net Security, Fortinet has not said when or where the attacks were spotted, how many systems were compromised, or who is behind them.

Which versions are affected

The Fortinet advisory lists four affected release branches:

  • FortiMail 8.0.0 through 8.0.1 (upgrade to 8.0.2 or above)
  • FortiMail 7.6.0 through 7.6.6 (upgrade to 7.6.7 or above)
  • FortiMail 7.4.0 through 7.4.8 (upgrade to 7.4.9 or above)
  • FortiMail 7.2.0 through 7.2.9 (no fix on this branch; upgrade to branch 7.4 or above)

Fortinet says it remediated FortiMail Cloud on October 5, 2026, by updating its firmware to 7.6.7 or 8.0.2, and that FortiMail Cloud customers need not take any action.

There is one discrepancy. The affected-product data that Fortinet supplied as the CVE numbering authority, published in the CVE.org record, also lists FortiMail 7.0.0 through 7.0.9 as affected. The 7.0 branch does not appear in the vendor advisory's table, and NVD's own CPE configuration covers only the 7.2 through 8.0 ranges. Organizations still running 7.0 should not read the advisory's silence as confirmation that they are unaffected.

Fixes came after the disclosure

The fixes were not available on day one. When Help Net Security reported the flaw on October 2, it said no patches were available yet and that fixes were planned for 8.0.2, 7.6.7 and 7.4.9. The Hacker News, the same day, also described those releases as upcoming. Fortinet published the advisory on October 1, added a solution update on October 5 and clarified the FortiMail Cloud fix on October 7, 2026. Until fixed builds were installed, administrators had to rely on the workarounds below.

Interim workarounds

For devices that cannot be upgraded yet, the Fortinet advisory lists three options:

  • Turn off the IBE (identity-based encryption) service.
  • Disable access to the FortiMail webmail interface from the internet, or limit it to trusted private networks.
  • Where a web application firewall sits in front of FortiMail, block the traversal pattern in requests to the IBE endpoint.

Help Net Security and The Hacker News, both reporting on October 2, also listed blocking internet access to the management interface, or restricting it to a trusted private network, alongside disabling IBE.

Indicators of compromise

Fortinet shared files, IP addresses and log entries that administrators can use to check for compromise, Help Net Security reported. The Fortinet advisory lists two attacker IP addresses, 79.141.169[.]187 and 45.129.0[.]192, along with system event log entries that include:

  • A root-level cron entry running a shell command that references /migadmin.
  • An administrator logout entry reading "User admin logged out from (null)."
  • A CLI configuration change adding an archive account named archive234 set to send data to 79.141.169[.]187.

The advisory also lists encryption log entries, including an IBE decrypter error reading "Invalid Base64 Encoding at pos 0" and failed logins by an internal user of the form *@domain.tld.

The Hacker News listed file indicators:

  • Files added under /data/lib and /data/bin, plus /data/etc/ld.so.preload
  • Modified files including /data/etc/httpd.conf and /data/migadmin.tar.gz

What It Means for Defenders

  • Inventory first. Find every FortiMail appliance and virtual instance, record its exact build, and compare it with the version list above, including any 7.0 deployments.
  • Upgrade. Move each device to the fixed build for its branch; plan the branch migration for anything on 7.2.
  • Mitigate what you can't patch today. Apply Fortinet's workarounds and keep webmail and the management interface off the internet.
  • Hunt as well as patch. Check each appliance and its logs against the indicators above, including unexpected archive accounts, cron entries and changes to the web server configuration. Treat any match as an incident.
  • Federal agencies: remediate any FCEB system still exposed under BOD 26-04, complete CISA's forensics triage requirements, and discontinue use of the product where mitigations are unavailable.

Sources