CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Fortinet FortiMail

product · product:fortinet-fortimail

Coverage
1
first 2026-10-02 → last 2026-10-08
Latest activity
2026-10-06
Fortinet now names fixed FortiMail builds for an unauthenticated file-write flaw it confirmed exploited as a…
Peak priority
critical
1 critical
Targets
public-sector
sectors: public-sector, technology
Sources cited
8
8 hosts

Action items (3)

Do-now tasks recorded on the entries about Fortinet FortiMail, newest first. Check the date before acting on an older one.

  • Immediate action: Fortinet reports in-the-wild exploitation of an unauthenticated file-write flaw in FortiMail and, since 2026-10-05, names the fixed builds 8.0.2, 7.6.7 and 7.4.9 (7.2 moves to branch 7.4 or above). Upgrade every self-managed appliance now (FortiMail Cloud was remediated by Fortinet on 2026-10-05); where the upgrade has to wait, disable IBE support with the vendor's CLI command, or cut the FortiMail webmail interface off from the internet, or block POST requests to /ibe that contain '../' at a web application firewall in front of FortiMail. Then check every appliance that was reachable against the compromise artifacts in advisory FG-IR-26-175, looking back to at least 2026-07-22.
    2026-10-02CVE-2026-104286
  • Upgrade every self-managed FortiMail to the fixed build for its branch (8.0.2, 7.6.7 or 7.4.9; 7.2 moves to branch 7.4 or above, which means 7.4.9 or later; FortiMail Cloud customers need not act); until each appliance is upgraded, disable IBE support (config system encryption ibe, set status disable) or, as Fortinet's alternatives, cut the webmail interface off from the internet or block POST requests to /ibe containing '../' at a web application firewall in front of it.
    2026-10-02CVE-2026-104286
  • Check every FortiMail that was internet-reachable before the workaround against the cron, CLI-audit and log artifacts in FG-IR-26-175 and the file artifacts that BleepingComputer and NCSC Switzerland describe, looking back to at least 2026-07-22, including a mail archive account that sends to a remote host and mail copied to destinations outside the organization.
    2026-10-02CVE-2026-104286

Defender insights

What each entry about Fortinet FortiMail tells a defender to do, newest first.

2026-10-02CRITICALexploitedFortinet now names fixed FortiMail builds for an unauthenticated file-write flaw it confirmed exploited as a zero-day

Exposure · detection

Story timeline

  1. 2026-10-02CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)
    trending-vulnerabilitiesFortinet now names fixed FortiMail builds for an unauthenticated file-write flaw it confirmed exploited as a zero-day

Hunting pivots

CVEs (exploited first)
CVE-2026-104286
Releases covered
Fortinet FortiMail
Tags
actively-exploitedcisa-kevpatch-availablepath-traversalpre-authvulnerabilities
ATT&CK techniques (5 across 6 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionScheduled Task/Job: Cron · Hijack Execution Flow: Dynamic Linker Hijacking
  • PersistenceScheduled Task/Job: Cron · Compromise Host Software Binary
  • Privilege EscalationScheduled Task/Job: Cron
  • StealthHijack Execution Flow: Dynamic Linker Hijacking
  • CollectionEmail Collection

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

Execution TA0002

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

T1574.006Hijack Execution Flow: Dynamic Linker Hijacking×1

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name. Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

Persistence TA0003

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

T1554Compromise Host Software Binary×1

Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

Privilege Escalation TA0004

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

Stealth TA0005

T1574.006Hijack Execution Flow: Dynamic Linker Hijacking×1

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name. Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

Collection TA0009

T1114Email Collection×1

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Evidence: 2026-10-02/cve-2026-104286-fortimail-path-traversal-zero-day-kev · ATT&CK page ↗

Entries about Fortinet FortiMail (1)

2026-10-02 · view entry permalink →

CRITICALCVE-2026-104286exploitedupdatedNATOA2

CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)

Fortinet published advisory FG-IR-26-175 on 2026-10-01 for CVE-2026-104286, a path traversal combined with improper neutralization of a NULL byte in FortiMail that may let an unauthenticated attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests (Fortinet PSIRT, 2026-10-01). Fortinet says the flaw "has been reported to be exploited in the wild" (Fortinet PSIRT, 2026-10-01), its own product-security team found it, and BleepingComputer reports a CVSS score of 9.8 and describes the flaw as affecting the management interface (BleepingComputer, 2026-10-01). CISA added the CVE to its KEV catalog on 2026-10-01 (CISA, 2026-10-01). Fortinet names no actor, victim count or date of first exploitation; Belnet's account, described below, supplies a date and one victim.

Affected are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9; Fortinet's revision of 2026-10-05 names 8.0.2, 7.6.7 and 7.4.9 as the fixed builds and tells 7.2 users to move to branch 7.4 or above, which means 7.4.9 or later because 7.4.0 through 7.4.8 are affected (Fortinet PSIRT, 2026-10-01). Fortinet lists three workarounds: disable IBE feature support in the GUI or with a CLI command; alternatively disable access to the FortiMail webmail interface from the internet or limit it to a trusted private network; or, where a web application firewall sits in front of FortiMail, block POST requests to /ibe that contain '../' (Fortinet PSIRT, 2026-10-01). BleepingComputer (2026-10-01) and NCSC Switzerland (2026-10-02) word the second workaround as restricting the management interface, while the advisory says the webmail interface (BleepingComputer, 2026-10-01; NCSC Switzerland, 2026-10-02).

Fortinet's advisory lists attacker addresses and the system events that exploitation left behind: a cron job running a command that references the /migadmin path, an admin CLI session that added a mail archive account sending to a remote host, and IBE decrypter exceptions for invalid Base64 input plus failed internal-user logins (Fortinet PSIRT, 2026-10-01). BleepingComputer reports that Fortinet's advisory also listed files added or modified on compromised appliances, a library added under the data partition, an added ld.so.preload file, a modified system binary, two added binaries, a modified web server configuration and a modified migadmin archive, and reads the archive account as a possible path to send archived data to a remote server (BleepingComputer, 2026-10-01); Fortinet's page carries no such file table, and NCSC Switzerland also lists malicious binaries and modified system files (NCSC Switzerland, 2026-10-02).

This has been reported to be exploited in the wild, customers are urged to apply the workaround below.

Disable the IBE feature support via the GUI ( Encryption -> IBE -> IBE Service 'off' ) or with the following CLI command:

2026-10-05: Solution update

Disable access to the FortiMail webmail interface from the internet or limit the access only from trusted private network

block POST requests to /ibe that contain '../'

Please note that Fortinet has remediated this issue on oct 05, 2026 in FortiMail Cloud by updating all the firmwares to v7.6.7 GA or v8.0.2 GA, hence the FortiMail Cloud customers need not perform any action.

Fortinet PSIRT (FG-IR-26-175) 2026-10-01

The incident was caused by the exploitation of a zero-day vulnerability affecting technology provided by our external supplier Fortinet.

Belnet 2026-10-02

Observed attacks deploy malicious binaries and modified system files

NCSC Switzerland (Cyber Security Hub) 2026-10-02
Updaterun 2026-10-03T0404Z-intelsummaryimmediate_actionactionsbodycvessourcesevidenceverificationsourcing_notereferences

Belnet, the Belgian government and research network (Risky Bulletin, 2026-09-30), updated its incident notice on 2026-10-02 to say its incident was caused by a zero-day in technology from its supplier Fortinet and to link this advisory for the vulnerability and its CVE, without naming FortiMail (Belnet, 2026-10-02). Belnet says attackers copied all incoming mail to its domains between 2026-07-22 and the morning of 2026-09-25 and that the vulnerability was remediated on 2026-09-25 at 08:10, without saying how (Belnet, 2026-10-02). Read with the advisory, the notice puts exploitation of this flaw about ten weeks before Fortinet's 2026-10-01 disclosure, against a European government network whose loss was bulk inbound mail.

NCSC Switzerland's advisory of 2026-10-02 says observed attacks deploy malicious binaries and modified system files (NCSC Switzerland, 2026-10-02). Fortinet's advisory words its second workaround as disabling access to the FortiMail webmail interface from the internet and adds an option to block POST requests to /ibe that contain '../' at a web application firewall (Fortinet PSIRT, 2026-10-01); BleepingComputer and NCSC Switzerland word the second workaround as the management interface.

Updaterun 2026-10-06T0405Z-inteltitleheadlinesummaryimmediate_actiontagscvessourcesevidencesourcing_noteactionsbody

Fortinet revised advisory FG-IR-26-175 on 2026-10-05: its timeline now lists a solution update and its solution table names fixed builds for every affected branch, 8.0.2 for 8.0.0 through 8.0.1, 7.6.7 for 7.6.0 through 7.6.6 and 7.4.9 for 7.4.0 through 7.4.8, with FortiMail 7.2.0 through 7.2.9 told to upgrade to branch 7.4 or above (Fortinet PSIRT, 2026-10-01). The advisory's structured record is dated 2026-10-05 and lists 8.0.2, 7.6.7 and 7.4.9 as not affected (Fortinet PSIRT CSAF record, 2026-10-05). The workarounds, the compromise artifacts and the lookback to 2026-07-22 are unchanged, so a workaround remains the interim control for any appliance that cannot be upgraded at once (Fortinet PSIRT, 2026-10-01).

Improvementrun 2026-10-08T0404Z-intelsummaryimmediate_actionactionsevidencebody

Fortinet's revision of 2026-10-07 adds a FortiMail Cloud clarification to the advisory: Fortinet remediated the issue on 2026-10-05 in FortiMail Cloud by updating all firmware to 7.6.7 or 8.0.2, so FortiMail Cloud customers need not perform any action (Fortinet PSIRT, 2026-10-01). The upgrade and workaround instructions above therefore apply to self-managed appliances; the advisory still shows the flaw as exploited in the wild and its fixed builds, workarounds and compromise artifacts are unchanged (Fortinet PSIRT, 2026-10-01).

Builds on: A national research and government network had its mail copied for 65 days through a zero-day…

vulnerability02 Oct 04:44Zmulti-sourceOpen finding →
Sources: Fortinet PSIRT (FG-IR-26-175) · BleepingComputer · CISA · Belnet · NCSC Switzerland (Cyber Security Hub) · NCSC-NL · Risky Bulletin · Fortinet PSIRT (FG-IR-26-175 CSAF record)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • advisories.ncsc.nl1 (12%)
  • belnet.be1 (12%)
  • bleepingcomputer.com1 (12%)
  • cisa.gov1 (12%)
  • filestore.fortinet.com1 (12%)
  • fortiguard.com1 (12%)
  • news.risky.biz1 (12%)
  • security-hub.ncsc.admin.ch1 (12%)
All cited sources (8)