Request Demo
Home › Blog
Security

FortiMail zero-day CVE-2026-104286: patch status and what to do

A CVSS 9.8 FortiMail flaw that allows unauthenticated file writes is being exploited in the wild. Affected versions, patch status, traces to look for and what to do today.

Boran Yazılım·25 October 2026
Padlock and envelope representing an email gateway vulnerability

On 1 October 2026 Fortinet disclosed CVE-2026-104286, a critical flaw in the FortiMail email security gateway. It lets an attacker write files to the system without authentication. The flaw was already being exploited in the wild at disclosure, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the same day. Organizations running FortiMail on their own servers or virtual appliances should check their version today. There is no fix for the 7.2 branch; Fortinet recommends moving to 7.4.

Technical summary

According to Fortinet advisory FG-IR-26-175, the flaw stems from a path traversal (CWE-22) and improper handling of NULL characters (CWE-158). An unauthenticated attacker can write arbitrary files to the underlying system with crafted HTTP or HTTPS requests. The CVSS v3 score is 9.8 (critical). The flaw is credited to Gwendal Guégniaud of Fortinet's product security team.

Fortinet has acknowledged exploitation, and CISA set a deadline of 4 October 2026 for federal civilian agencies. Fortinet has not said when the attacks began, how many systems were hit or who is behind them.

Affected versions

Affected on-premises versions:

  • FortiMail 8.0.0-8.0.1
  • FortiMail 7.6.0-7.6.6
  • FortiMail 7.4.0-7.4.8
  • FortiMail 7.2.0-7.2.9

For FortiMail Cloud, Fortinet says it has fixed the issue itself and cloud customers need take no action. The exposure therefore sits with organizations that run FortiMail on their own servers or virtual appliances. Email gateways are often left alone once installed; the lack of a fix for 7.2 shows that their version lifecycle needs tracking too.

Patch status (as of 25 October 2026)

At disclosure there was no fixed release; 8.0.2, 7.6.7 and 7.4.9 were listed as upcoming. Fortinet updated the advisory with a "solution update" on 5 October. It now lists these upgrade targets:

  • 8.0 branch: 8.0.2 or above
  • 7.6 branch: 7.6.7 or above
  • 7.4 branch: 7.4.9 or above
  • 7.2 branch: no fix; Fortinet advises moving to the 7.4 branch or later

The advisory does not give a release date for the on-premises builds, and secondary sources disagree, with dates ranging from 5-6 October to 21 October. Since the exact release date is not yet clear, confirm the build on Fortinet's support portal and download it from there.

What to do today

  • Check your version. If it falls in one of the ranges above, treat the system as vulnerable.
  • Close the management interface and webmail to the internet, or allow access only from trusted private networks.
  • Until you patch, turn off the IBE (identity-based encryption) service. In the GUI this is under Encryption > IBE; in the CLI, enter config system encryption ibe, then set status disable, then end.
  • If a WAF sits in front, add a rule blocking POST requests to the /ibe path that contain ../ (one of the interim measures Fortinet suggests).
  • Upgrade to a fixed build: 8.0.2, 7.6.7 or 7.4.9 and above. If you run 7.2, move to 7.4.9 or above.
  • After patching, still review logs and indicators of compromise (IOCs), because the flaw may have been exploited before the fix.

Traces to look for

Indicators reported by The Hacker News (see Fortinet's advisory for the authoritative, current list):

  • IP addresses: 79.141.169[.]187 and 45.129.0[.]192
  • Files added: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload
  • Files modified: /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz

If any of these files exist or you see connections to these IP addresses, treat the device as compromised. Isolate it, preserve evidence, rotate passwords and keys, and consider rebuilding from a clean image. Finding none of the indicators does not prove the system is clean.

Why the email gateway comes first

An email gateway faces the internet, and all of an organization's external correspondence passes through it. It holds the content of inbound and outbound mail, user accounts and certificates. Unauthenticated file write on such a device can give an attacker persistence, the ability to read or alter messages, and a path into the internal network. Fortinet products have been frequent targets in the past, so do not leave patching and access restrictions for the next maintenance window.

If you need help with version checks, patching or IOC review, you can reach us at https://boransoftware.com/en/iletisim/

Sources

← BlogRequest Demo