Fortinet has confirmed that a critical zero-day vulnerability in its FortiMail email security appliances is being exploited in real-world attacks. Tracked as CVE-2026-104286, the bug carries a severe CVSS score of 9.8 and allows attackers without login credentials to write arbitrary files to systems via carefully constructed HTTP or HTTPS requests. The issue combines path traversal (CWE-22) and improper null byte handling (CWE-158), enabling threat actors to escape directory restrictions and inject files into protected areas of FortiMail devices.
Affected Versions & Workarounds
Fortinet’s advisory, published October 1, 2026, names multiple branches as vulnerable: FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and 7.2.0-7.2.9. Fixes are slated for upcoming releases—namely versions 8.0.2, 7.6.7, and 7.4.9 or newer. For organizations still on branch 7.2, Fortinet recommends upgrading to branch 7.4 or later, but warns that early 7.4 builds remain vulnerable.
Until patched versions are installed, administrators can apply a workaround by disabling the IBE (Internet-Based Encryption) feature: via the CLI issue “config system encryption ibe”, “set status disable”, then “end”. Another mitigation is to block external access to the FortiMail management interface or limit it strictly to trusted internal networks.
Indicators of Compromise: What to Look For
The advisory outlines several telltale signs of exploitation. New or modified files detected at locations like /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and /data/etc/ld.so.preloadshould raise red flags. Other suspicious artifacts include unexpected modifications to /bin/smit, /data/etc/httpd.conf, and archives such as /data/migadmin.tar.gz.
Additional signs include log entries revealing root cron jobs involving “/migadmin”, failed internal user logins, logout events with null interface values, and IBE decryption errors citing invalid Base64 data. Also relevant are stale archive-style accounts like “archive234” forwarding data to IP address 79.141.169.187 under “/uploads”. These indicators should be evaluated together rather than in isolation.
Though the full attack chain remains undisclosed—including which actors are responsible or how widespread compromise already is—Fortinet confirms that exploitation is happening now. The vendor urges all customers to act immediately rather than wait for more details.
Defending against this vulnerability requires urgency. Admins should apply workarounds immediately, maintain extensive logging, and audit for any of the listed indicators. Restricting or eliminating public access to the FortiMail management interface further reduces exposure. Until fixed firmware is widely deployed, these mitigations are the frontline defense.
This flaw underscores a growing trend: email security appliances themselves are now prime targets for attackers. As organizations increasingly rely on secure messaging, vulnerabilities in those systems have outsized impact. What to watch: how quickly fixed versions roll out, whether there’s indication of a supply-chain or mass-scan campaign, and how many instances have already been compromised.
