FortiMail zero-day CVE-2026-104286 is being exploited, and there is no patch yet
An unauthenticated, CVSS 9.8 file-write flaw in FortiMail's IBE webmail portal is under active attack. Fixed builds are still "upcoming", so the workaround is the only defense right now.
Fortinet disclosed a critical zero-day in FortiMail, its email security gateway, on October 1, 2026. Tracked as CVE-2026-104286 and rated CVSS 9.8, the bug lets an unauthenticated attacker write arbitrary files to the appliance with crafted HTTP or HTTPS requests, and Fortinet says it has been exploited in the wild.
The awkward part: as of October 5, the fixed builds for the supported branches are still listed as "upcoming". Admins have to rely on a workaround - switching off the Identity Based Encryption (IBE) feature or pulling webmail off the internet - and check their appliances for signs of compromise.
What Fortinet disclosed
The advisory, FG-IR-26-175, describes a path traversal flaw (CWE-22) combined with improper handling of NULL bytes (CWE-158) in the FortiMail GUI. In Fortinet's words, it "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. This has been reported to be exploited in the wild, customers are urged to apply the workaround below."
- Severity: Critical, CVSSv3 9.8 (AV:N/AC:L/PR:N/UI:N)
- Attack type: unauthenticated, over the network
- Impact listed by Fortinet: execute unauthorized code or commands
- Known exploited: yes
- Virtual patch: no
- Discovery: found internally by Gwendal Guégniaud of Fortinet's Product Security team
Writing arbitrary files to an appliance is usually a short step from running code on it. Secondary analysis points to the expected consequences: full compromise of the gateway, theft of email passing through it and a foothold for moving deeper into the network.
Which FortiMail versions are affected
Every supported branch is affected. Fortinet's solution table points to builds that had not shipped at the time of writing:
- FortiMail 8.0.0 through 8.0.1 - upgrade to upcoming 8.0.2 or above
- FortiMail 7.6.0 through 7.6.6 - upgrade to upcoming 7.6.7 or above
- FortiMail 7.4.0 through 7.4.8 - upgrade to upcoming 7.4.9 or above
- FortiMail 7.2.0 through 7.2.9 - no 7.2 fix; move to the 7.4 branch or above
No fixed build yet
Do not assume you are patched because you upgraded recently. The advisory's timeline still shows only the October 1 initial publication, and 7.4.9, 7.6.7 and 8.0.2 are marked "upcoming". Some summaries imply the fixes are out - they are not. Users on 7.2 face a branch migration on top of that, to a branch that is itself waiting for 7.4.9.
Why the IBE portal is exposed by design
The vulnerable surface is FortiMail's Identity Based Encryption. IBE encrypts a message using a public key generated from the recipient's email address, so recipients do not need to install software or enroll keys in advance. They get a notification and read the message through FortiMail's webmail portal, under the /ibe path.
That convenience is the problem here. For IBE to work with outside recipients, the portal has to be reachable from the internet, which puts the vulnerable code path in front of anyone who can send it a request.
What to do right now
Until fixed builds ship, Fortinet's workaround is the mitigation. Pick one of the following:
- Disable IBE in the GUI: Encryption -> IBE -> set IBE Service to "off".
- Or disable it from the CLI with the commands below.
- If you need IBE, block webmail access from the internet or limit it to a trusted private network.
- If a web application firewall sits in front of FortiMail, block POST requests to /ibe that contain "../".
config system encryption ibe
set status disable
endTurning off IBE stops external recipients from opening encrypted messages, so warn the teams that rely on it. Then plan the upgrade to 7.4.9, 7.6.7 or 8.0.2 as soon as Fortinet releases them, and move 7.2 appliances to a supported branch.
Mitigation is not cleanup
The workaround closes the door, but it does not remove anything an attacker already wrote to the appliance. Exploitation started before disclosure, so check for the indicators below whether or not you have applied the workaround.
How to tell if you were hit
Network indicators
Fortinet lists two attacker IP addresses (defanged here): 79[.]141.169.187 and 45[.]129.0.192. Search firewall, proxy and FortiMail logs for connections to or from either.
Log indicators
- A cron entry run as root by ui=cron that references /migadmin
- An "admin logged out from (null)" event
- A configuration event adding an archive account named "archive234" with destination remote, remote-ip 79[.]141.169.187 and remote-directory /uploads
- IBE encryption log errors reading "Invalid Base64 Encoding at pos 0. Character=0x2a" from FortiMail::IBE::DecrypterMediaIn
- "Internal user *@domain.tld failed to log in" messages
The archive account is the most alarming entry. Mail archiving to a remote server is a legitimate FortiMail feature, and here it appears to be used to copy an organization's email to an attacker-controlled host.
File indicators
The Hacker News reports these file changes on compromised appliances. Note that they come from its reporting, not from the PSIRT advisory itself:
- Added: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload
- Modified: /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz
A new ld.so.preload file alongside an unfamiliar shared library is consistent with a library-preload persistence mechanism, which would load attacker code into processes on the appliance. If you find any of these indicators, treat the gateway as compromised: preserve evidence, rebuild from a clean image, rotate credentials stored on or passing through it, and review what mail may have been archived out.
CISA gave federal agencies three days
CISA added CVE-2026-104286, "Fortinet FortiMail Path Traversal Vulnerability", to its Known Exploited Vulnerabilities catalog on October 1, citing Binding Operational Directive 26-04. Federal Civilian Executive Branch agencies were told to apply the patch or the workaround by October 4 - a three-day window that reflects how seriously the agency rates the risk.
The deadline only binds US federal agencies, but the KEV catalog is widely used as a priority list. A KEV entry with no patch available leaves everyone else with the same choice: apply the workaround now.
What is still unknown
Fortinet and CISA confirm exploitation but have not said how many organizations were hit, who is behind the attacks, or how many FortiMail appliances expose IBE to the internet. There is also no release date for the fixed builds. We will update this article when Fortinet ships 7.4.9, 7.6.7 and 8.0.2.
Sources
- Fortinet PSIRT advisory FG-IR-26-175: https://fortiguard.fortinet.com/psirt/FG-IR-26-175
- CISA KEV alert, October 1, 2026: https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog
- FortiMail 7.6 administration guide, Configuring IBE encryption: https://docs.fortinet.com/document/fortimail/7.6.0/administration-guide/286643/configuring-ibe-encryption
- The Hacker News: https://thehackernews.com/2026/10/critical-fortimail-zero-day-flaw.html
- Field Effect: https://fieldeffect.com/blog/patches-pending-actively-exploited-fortimail-flaw
Key takeaways
- CVE-2026-104286 is an unauthenticated, CVSS 9.8 arbitrary file write in FortiMail's IBE webmail, exploited in the wild before disclosure.
- FortiMail 7.2, 7.4, 7.6 and 8.0 are affected; fixed builds 7.4.9, 7.6.7 and 8.0.2 were still "upcoming" as of October 5, and 7.2 has no fix of its own.
- Disable IBE (config system encryption ibe / set status disable / end) or restrict webmail to trusted networks now.
- Hunt for the published IoCs, especially a remote archive account named "archive234", which suggests email exfiltration.
- CISA added the flaw to KEV on October 1 with an October 4 deadline for federal agencies.
More in Tech News
Browse Tech News