FortiMail Zero Day CVE-2026-104286 Exploited, No Patch Yet

If your company runs FortiMail in gateway mode, every inbound message stops at that appliance before it reaches an employee's inbox. Fortinet's operation mode documentation puts it plainly: a "Simple DNS MX record change redirects email to FortiMail for antispam and antivirus scanning."

Now that box is the target. Fortinet's advisory FG-IR-26-175 covers CVE-2026-104286, a bug that lets anyone who can reach the appliance over HTTP or HTTPS write files to its disk without logging in. Fortinet says it "has been reported to be exploited in the wild." There is no fixed build to install yet.

Key Takeaways

• CVE-2026-104286 is a path traversal and null byte flaw (CWE-22 and CWE-158), rated CVSS 9.8, that lets an unauthenticated attacker write arbitrary files on a FortiMail appliance through crafted HTTP or HTTPS requests.
• Fortinet lists FortiMail 7.2.0 to 7.2.9, 7.4.0 to 7.4.8, 7.6.0 to 7.6.6 and 8.0.0 to 8.0.1 as affected, and its fixes, 7.4.9, 7.6.7 and 8.0.2, were all still marked "upcoming" on October 2, 2026.
• CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 1 and gave federal agencies until October 4 to mitigate it and complete a forensic triage.
• One of Fortinet's indicators is an archive account named archive234 that stores archived mail on 79.141.169.187, which is also one of the two IP addresses the advisory lists as indicators of compromise.
• Until patches ship, Fortinet's workarounds are to disable the IBE (Identity Based Encryption) feature or block internet access to the FortiMail management interface.

What Is CVE-2026-104286?

CVE-2026-104286 is an unauthenticated arbitrary file write in FortiMail, Fortinet's email security gateway, caused by a path traversal weakness combined with improper handling of null bytes.

Fortinet scores it 9.8 with the vector AV:N/AC:L/PR:N/UI:N: reachable over the network, low complexity, no account and no user interaction needed. The advisory tags the component as "GUI" and the impact as "Execute unauthorized code or commands."

Path traversal means a filename in a request can climb out of the directory it was supposed to stay in. A null byte flaw, in the words of MITRE's CWE-158 entry, "may cause the product to believe the input is terminated earlier than it actually is," which lets dangerous input slip past a validation check. Fortinet has not published a root cause or a proof of concept.

The advisory credits Gwendal Guégniaud of Fortinet's product security team with finding it internally, yet also marks it known exploited. Fortinet has not said when exploitation began or how many systems were hit, and it has not named the attackers, according to BleepingComputer.

Which FortiMail Versions Are Affected, and Is There a Patch?

Four FortiMail branches are affected, and when we checked Fortinet's advisory on October 2, 2026, none of them had a released fix.

The 7.2 row needs a second look. BleepingComputer wrote that 7.2 users "can patch the vulnerability by upgrading to the 7.4 branch or later." Today that move lands them on 7.4.8 at best, which the same advisory lists as vulnerable. Until 7.4.9 ships, a branch jump fixes nothing, and the workarounds below are the only protection.

Scanner users face a second trap. The machine readable part of the CVE.org record disagrees with Fortinet's table. Its affected ranges stop at 8.0.0, 7.6.5 and 7.4.6, add a 7.0 branch the advisory never mentions, and mark every unlisted version "unaffected" by default. Its solution field even names FortiRecorder builds. A tool that trusts those fields could report 8.0.1, 7.6.6, 7.4.7 or 7.4.8 as clean. The record's prose description, and the NVD entry that copies it, do match the advisory. Go by the advisory.

What Did the Attackers Do on the Appliance?

Fortinet's indicators show attackers adding and replacing files on the appliance, then changing its configuration from the admin command line. The advisory lists seven files with MD5 and SHA-256 hashes:

• Added: /data/lib/liblog.so and /data/etc/ld.so.preload
• Added: /data/bin/webconsole and /data/bin/mailservice
• Modified: /bin/smit, /data/etc/httpd.conf and /data/migadmin.tar.gz

The preload pair is the one to understand. On Linux, an ld.so.preload file tells the dynamic linker to load the listed libraries into programs as they start. MITRE catalogs this as Dynamic Linker Hijacking, technique T1574.006, and lists malware that modified /etc/ld.so.preload "to hook libc functions in order to hide the installed dropper and mining software in process lists." Fortinet has not said what liblog.so does. Until it does, do not treat a clean process list from a suspect appliance as proof of anything.

The log excerpts show a root cron job running a shell command that starts O=/migadmin, an admin logout "from (null)," and failed logins by an internal user that the excerpt shows as *@domain.tld. One line is an exception inside FortiMail's IBE decrypter: "Invalid Base64 Encoding at pos 0. Character=0x2a." Hex 0x2a is the ASCII asterisk. Fortinet does not explain these lines, but its first workaround is to switch IBE off, so the IBE service is where defenders should start looking. The advisory lists two IP addresses as indicators: 79.141.169.187 and 45.129.0.192.

Why Is the Archive Account the Scary IOC?

The archive account matters because it turns a gateway that normally keeps no mail into one that ships copies to the attacker. In gateway and transparent modes, Fortinet's documentation says, "FortiMail does not locally store email unless queued, quarantined, or archived." Archiving is the built in exception. This is the configuration event Fortinet published:

msg="Added 'archive234' to 'archive account' : rotation-size[50]rotation-time[1] rotation-hour[14]destination[remote]remote-ip[79.141.169.187]remote-username[archive234]remote-password[***]remote-directory[/uploads] (user: admin, from: cli)"

Read against Fortinet's archive account CLI reference, each field has a plain meaning:

• destination[remote]: archive to a remote server rather than the local disk, over FTP or SFTP.
• remote-ip[79.141.169.187]: that remote server is one of the two IP addresses Fortinet lists as indicators, with mail landing in /uploads.
• rotation-size[50]rotation-time[1]: close out the archive mailbox at 50 MB or one day old, whichever comes first. The defaults are 200 MB and seven days, so this setup produces smaller batches more often.
• (user: admin, from: cli): the change ran under the admin account from the command line.

One caveat matters for hunting. An archive account only holds what archive policies or journaling send it, and each policy names its target account. The published excerpt shows only the account. Check the policies and journaling settings too, plus each account's forward-address, which per Fortinet forwards "all archived messages" to an email address as well.

What This Means for Your Inbox

An email security gateway is a man in the middle by design. It sits there to open every message, which is exactly what an intruder wants. Fortinet documents FortiMail integrations with Microsoft 365 and Google Workspace, and its API protection workflow starts "by creating an account on FortiMail with the Microsoft 365 or Google Workspace domain administrator's credentials." An attacker who can write to /bin on that appliance is sitting next to whatever it stores for the tenant behind it.

IBE raises the stakes. Fortinet's IBE guide says recipients "log in to the FortiMail unit to read email," and "When the recipient opens the mail on the FortiMail unit, the email is decrypted automatically." The mail a company judged too sensitive to send in the clear is the mail that lives on this box.

If you write to a FortiMail customer from Gmail or Outlook.com, you will see none of this. If a company you correspond with discloses a FortiMail compromise, assume anything you exchanged with it during the exposure window could have been read, and be wary of follow ups that quote those threads back to you.

Two Email Gateways in KEV in 17 Days

By our search of CISA's KEV catalog, CVE-2026-104286 and Cisco's CVE-2026-76461 are the only email security gateway flaws added in 2026, and they arrived 17 days apart. We covered the Cisco bug in Cisco Email Gateway Zero Day: One Email Gets Root. Both entries carry a three day deadline and a forensic triage requirement. Under BOD 26-04, that means agencies must remediate or mitigate within three days and also assess whether the system is already compromised.

The bug class has shown up in this product category before. In May, researchers disclosed an unauthenticated path traversal file write in SEPPmail, another gateway built around encrypted mail. And the FortiMail news lands six days after Kiteworks told customers to power down its secure file sharing servers.

The response clock has tightened. KEV lists one earlier FortiMail flaw, CVE-2025-32756, a stack overflow shared with FortiVoice, FortiNDR and FortiFone, added on May 14, 2025 with a June 4 due date. That was 21 days, under the rules then in force, with no triage. This time it is three days, with triage.

What Should FortiMail Admins Do Now?

Admins should preserve evidence, apply a workaround today and hunt for the indicators, then patch once fixed builds ship.

1. Collect evidence first. CISA's forensic triage guidance warns: "Collect all required evidence prior to this step as patching may jeopardize the availability of artifacts." Export configuration and logs before changing anything.
2. Apply a workaround. Fortinet's first option disables IBE:

   config system encryption ibe
       set status disable
   end

   The alternative is to block internet access to the management interface or limit it to a trusted private network. Disabling IBE switches off the secure message service, so warn the people who read encrypted mail through it.
3. Check the seven files against the advisory hashes. Any /data/etc/ld.so.preload or /data/lib/liblog.so on the appliance is a red flag.
4. Audit archiving. Open Email Archiving > Archive Account > Archive Account, or config archive account in the CLI. Look for archive234, any remote destination you did not set up, unfamiliar forward addresses, and archive policies pointing at unknown accounts.
5. Search logs and firewall records for both IP addresses, cron entries that mention /migadmin, and admin CLI changes nobody on your team made.
6. On any hit, treat the box as compromised. Fortinet has published no cleanup steps. Our advice, not Fortinet's: rebuild from known good firmware, then rotate admin passwords and archive server credentials, plus any Microsoft 365 or Google Workspace credentials stored for API integration.
7. Patch when you can. Watch FG-IR-26-175 for 7.4.9, 7.6.7 and 8.0.2. On 7.2, plan the move to 7.4.9 or later, not to any 7.4 build available today.

Federal agencies have until October 4. Everyone else faces the same attackers on no deadline at all.