A critical FortiMail vulnerability, tracked as CVE-2026-104286, is being actively exploited right now. It lets an attacker with no password write files onto a FortiMail email gateway, which can lead to running their own code on the device. Fortinet’s permanent fixes are still listed as “upcoming”, so if you run FortiMail you should disable the IBE feature or block internet access to webmail today.
This guide explains what the flaw does, which versions are hit, the exact workaround, and how to check whether your gateway was already breached.
FortiMail Vulnerability: Key Facts
| Detail | Information |
|---|---|
| CVE | CVE-2026-104286 |
| Fortinet advisory | FG-IR-26-175 |
| Published | October 1, 2026 |
| Severity | Critical, CVSS 9.8 |
| Flaw type | Path traversal (CWE-22) + NULL byte handling (CWE-158) |
| Login needed? | No, unauthenticated |
| Impact | Arbitrary file write, code or command execution |
| Exploited in the wild? | Yes |
| CISA KEV | Added October 1, 2026 |
| Federal deadline | October 4, 2026 |
| Patch status | Fixes listed as “upcoming” |
What Is FortiMail?
FortiMail is Fortinet’s secure email gateway. Companies put it in front of their mail servers to filter spam, malware and phishing, and to encrypt sensitive messages.
That position is exactly what makes this bug dangerous. An email gateway sees a huge amount of business mail. If an attacker controls it, they may be able to read, copy or redirect messages.
If your organization doesn’t run FortiMail, you aren’t directly affected. But your business partners might be, so the breach risk can still reach your inbox.
How the CVE-2026-104286 Flaw Works
According to Fortinet’s advisory, the bug combines two weaknesses. One is a path traversal issue, where crafted file paths escape the folder they should stay in. The other is poor handling of NULL bytes in requests.
Together, they let an unauthenticated attacker write arbitrary files onto the system with crafted HTTP or HTTPS requests. Fortinet rates the impact as “execute unauthorized code or commands.”
The workaround points to the Identity-Based Encryption (IBE) feature as the attack path. IBE is the FortiMail feature that lets outside recipients open encrypted emails through a web portal.
Security firm watchTowr notes that deployments with the management interface exposed to the internet face the highest risk.
Who found it
Fortinet says the flaw was discovered internally by Gwendal Guégniaud of its Product Security team. It was already being exploited when the advisory went out, which is why it counts as a zero-day.
Affected FortiMail Versions
Check your version against this table. Every supported branch from 7.2 to 8.0 is affected.
| Branch | Vulnerable versions | Fortinet’s solution |
|---|---|---|
| FortiMail 8.0 | 8.0.0 through 8.0.1 | Upgrade to upcoming 8.0.2 or above |
| FortiMail 7.6 | 7.6.0 through 7.6.6 | Upgrade to upcoming 7.6.7 or above |
| FortiMail 7.4 | 7.4.0 through 7.4.8 | Upgrade to upcoming 7.4.9 or above |
| FortiMail 7.2 | 7.2.0 through 7.2.9 | Move to the 7.4 branch or later |
Important: when Fortinet published the advisory on October 1, the fixed builds were marked “upcoming.” Help Net Security confirmed on October 2 that they hadn’t been released yet. Check Fortinet’s support portal for the latest builds before you plan an upgrade.
Fortinet also lists no virtual patch for this issue, so don’t assume another Fortinet product is shielding you.
How to Mitigate the FortiMail Zero-Day Now
Until fixed versions ship, the workaround is your main defense. Fortinet gives you three options.
Understand what IBE does before you switch it off
According to Fortinet’s admin guide, IBE sends recipients a notification email with an HTML attachment that explains how to reach their encrypted message. Recipients then register or log in on the FortiMail unit to read it, and the message is decrypted automatically.
External recipients can only reach secure messages through the link in that notification. Internal users can also open them through webmail. So if you disable IBE, outside partners lose access to the encrypted-mail portal until it’s back on.
That can be a real cost for teams that regularly send sensitive mail to outside contacts. But it’s a much smaller cost than a compromised gateway.
Option 1: Disable IBE (recommended)
Turn off Identity-Based Encryption in the GUI under Encryption > IBE > IBE Service “off”. Or run this in the CLI:
- Enter config system encryption ibe
- Then set status disable
- Then end
The trade-off: outside recipients who rely on the IBE web portal won’t be able to open encrypted mail until you turn it back on. Plan a short notice for affected users.
Option 2: Lock down webmail access
Block access to the FortiMail webmail interface from the internet, or allow it only from trusted private networks. This is a good choice if you can’t disable IBE right away.
Option 3: Add a WAF rule
If a web application firewall sits in front of FortiMail, block POST requests to /ibe that contain “../”. Treat this as an extra layer, not your only fix.
Workaround comparison
| Option | Protection | Business impact |
|---|---|---|
| Disable IBE | Removes the reported attack path | Encrypted-mail portal goes offline |
| Restrict webmail | Cuts off internet attackers | Remote users may lose webmail |
| WAF rule | Filters known attack pattern | Low, but easier to bypass |
How to Tell If Your FortiMail Was Compromised
Because attacks started before the advisory, you should assume you might already be hit and check. Fortinet published these indicators of compromise.
Attacker IP addresses:
- 79[.]141.169.187
- 45[.]129.0.192
Suspicious log entries to search for:
- A system cron entry running a shell command that references /migadmin.
- An admin “logged out from (null)” event with an unknown reason.
- A new archive account (Fortinet’s example is named “archive234”) set to send archives to a remote IP, such as 79.141.169.187.
- IBE encryption log errors about “Invalid Base64 Encoding”.
- Failed logins for odd internal users like a wildcard address.
The Hacker News also reports that attackers modified or added files including liblog.so, ld.so.preload, httpd.conf and migadmin.tar.gz. An unexpected ld.so.preload file is a common sign of a persistent backdoor.
If you find a match
watchTowr recommends a careful response order:
- Preserve logs and forensic data before you change anything.
- Isolate the device from the internet.
- Remove rogue archive accounts and review all admin settings.
- Rotate credentials, including admin passwords and any keys stored on the gateway.
- Apply the fixed build as soon as Fortinet releases it.
Treat any mail that passed through a compromised gateway as potentially exposed. Large email-related leaks can snowball, as our coverage of the Pentagon data breach and the ShinyHunters FBI breach shows.
FortiMail Zero-Day Timeline
Here’s how events have moved so far.
| Date | Event |
|---|---|
| October 1, 2026 | Fortinet publishes advisory FG-IR-26-175 and confirms exploitation |
| October 1, 2026 | CISA adds CVE-2026-104286 to its KEV catalog |
| October 2, 2026 | Wide public reporting; fixed builds still not released |
| October 4, 2026 | CISA deadline for US federal civilian agencies |
| To be confirmed | Release of FortiMail 8.0.2, 7.6.7 and 7.4.9 |
A 24-Hour Action Plan for Admins
If you’re responsible for a FortiMail gateway, here’s a simple order of work you can follow today.
| When | Action |
|---|---|
| First hour | Confirm your FortiMail version and whether IBE is turned on |
| First hour | Disable IBE or block webmail access from the internet |
| Same day | Search logs and firewall records for the two attacker IPs |
| Same day | Review archive accounts, cron entries and admin accounts |
| Same day | Tell affected teams that the encrypted-mail portal is offline |
| When fixes ship | Upgrade to 8.0.2, 7.6.7 or 7.4.9, or move off the 7.2 branch |
| After upgrading | Decide whether to turn IBE back on, and keep monitoring |
If you rely on a managed service provider, don’t assume they’ve already done this. Ask them directly:
- Which FortiMail version are we running?
- Has the IBE workaround been applied, and when?
- Have you checked for Fortinet’s published indicators of compromise?
- When will you install the fixed build?
Why CISA’s Deadline Matters
CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026. US federal civilian agencies had until October 4, 2026 to apply the workaround or fix.
That deadline has already passed. If you’re a federal contractor or work in a regulated industry, expect auditors and customers to ask what you did and when.
Private companies aren’t bound by that deadline. Still, KEV listings are a clear signal that attacks are real, not theoretical.
What This Means for Everyday Email Users
If you’re not an IT admin, you don’t need to touch any settings. But a breached email gateway can lead to convincing phishing emails that seem to come from trusted contacts.
Be extra careful with unexpected invoices, password resets and file-sharing links over the next few weeks.
If a message from a company you know looks odd, don’t reply to it. Contact them through a phone number or address from their official website instead, and never approve payment changes by email alone. Our explainers on deepfake-as-a-service scams and how AI helps detect fraud show how attackers follow up on stolen data.
The Bottom Line
CVE-2026-104286 is a 9.8-rated, actively exploited FortiMail flaw with no released patch at the time of Fortinet’s advisory. If you manage FortiMail, disable IBE or restrict webmail access now, hunt for the indicators above, and upgrade as soon as the fixed builds arrive.
Source: Fortinet PSIRT advisory FG-IR-26-175.
Frequently Asked Questions
It’s a critical FortiMail flaw (CVSS 9.8) that lets an unauthenticated attacker write arbitrary files on the gateway using crafted HTTP or HTTPS requests. Fortinet confirms it is being exploited in the wild.
FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9 are affected. Fortinet lists 8.0.2, 7.6.7 and 7.4.9 as the upcoming fixed versions.
When Fortinet published its advisory on October 1, 2026, the fixed builds were marked “upcoming.” Until they’re available, Fortinet tells customers to apply the workaround.
In the GUI, go to Encryption > IBE and set IBE Service to off. In the CLI, run config system encryption ibe, then set status disable, then end.
Look for connections to 79.141.169.187 or 45.129.0.192, unknown archive accounts sending data to remote IPs, odd cron entries mentioning /migadmin, and IBE “Invalid Base64” log errors.
Not directly. It affects organizations that run FortiMail gateways. But if a gateway is compromised, attackers could read mail or send convincing phishing emails to you.
CISA added the flaw to its KEV catalog on October 1, 2026 and gave US federal civilian agencies until October 4, 2026 to fix or mitigate it.
