Critical FortiMail Zero-Day Flaw (CVE-2026-104286)

What it is

CVE-2026-104286, a critical path traversal (CWE-22) and NULL-byte handling (CWE-158) flaw in Fortinet FortiMail, CVSS 9.8, now on CISA's KEV catalog with confirmed in-the-wild exploitation.

How it works

An unauthenticated attacker sends crafted HTTP or HTTPS requests that exploit improper restriction of pathnames combined with improper neutralization of NULL bytes, allowing arbitrary file writes to the underlying filesystem.

Preconditions / Affected

• FortiMail 8.0.0 through 8.0.1
• FortiMail 7.6.0 through 7.6.6
• FortiMail 7.4.0 through 7.4.8
• FortiMail 7.2.0 through 7.2.9

No authentication is required; exposure of the management interface to the internet is the key risk factor.

What to do

Patches are pending for most branches; upgrade paths once available:

• 8.0.0–8.0.1 → 8.0.2 or above
• 7.6.0–7.6.6 → 7.6.7 or above
• 7.4.0–7.4.8 → 7.4.9 or above
• 7.2.0–7.2.9 → branch 7.4 or above (no 7.2 fix planned)

Interim workaround — disable IBE:

config system encryption ibe
set status disable
end

Also restrict the FortiMail management interface so it is not reachable from the internet (private/trusted networks only).

FCEB agencies are directed to apply the patch or workaround by October 4, 2026.

IOCs to check for compromise — attacker IPs: 79.141.169.187, 45.129.0.192; added files: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload; modified files: /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz.

Caveats

Fortinet has not yet released patched builds for most affected branches (fixes are "upcoming"); the IBE workaround and interface restriction are the only defenses until then. FortiMail 7.2 has no in-branch fix — upgrade to 7.4+ required.