CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)
Fortinet now names fixed FortiMail builds for an unauthenticated file-write flaw it confirmed exploited as a zero-day
Defender actions
- Upgrade every self-managed FortiMail to the fixed build for its branch (8.0.2, 7.6.7 or 7.4.9; 7.2 moves to branch 7.4 or above, which means 7.4.9 or later; FortiMail Cloud customers need not act); until each appliance is upgraded, disable IBE support (config system encryption ibe, set status disable) or, as Fortinet's alternatives, cut the webmail interface off from the internet or block POST requests to /ibe containing '../' at a web application firewall in front of it.
- Check every FortiMail that was internet-reachable before the workaround against the cron, CLI-audit and log artifacts in FG-IR-26-175 and the file artifacts that BleepingComputer and NCSC Switzerland describe, looking back to at least 2026-07-22, including a mail archive account that sends to a remote host and mail copied to destinations outside the organization.
Analysis
Fortinet published advisory FG-IR-26-175 on 2026-10-01 for CVE-2026-104286, a path traversal combined with improper neutralization of a NULL byte in FortiMail that may let an unauthenticated attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests (Fortinet PSIRT, 2026-10-01). Fortinet says the flaw "has been reported to be exploited in the wild" (Fortinet PSIRT, 2026-10-01), its own product-security team found it, and BleepingComputer reports a CVSS score of 9.8 and describes the flaw as affecting the management interface (BleepingComputer, 2026-10-01). CISA added the CVE to its KEV catalog on 2026-10-01 (CISA, 2026-10-01). Fortinet names no actor, victim count or date of first exploitation; Belnet's account, described below, supplies a date and one victim.
Affected are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9; Fortinet's revision of 2026-10-05 names 8.0.2, 7.6.7 and 7.4.9 as the fixed builds and tells 7.2 users to move to branch 7.4 or above, which means 7.4.9 or later because 7.4.0 through 7.4.8 are affected (Fortinet PSIRT, 2026-10-01). Fortinet lists three workarounds: disable IBE feature support in the GUI or with a CLI command; alternatively disable access to the FortiMail webmail interface from the internet or limit it to a trusted private network; or, where a web application firewall sits in front of FortiMail, block POST requests to /ibe that contain '../' (Fortinet PSIRT, 2026-10-01). BleepingComputer (2026-10-01) and NCSC Switzerland (2026-10-02) word the second workaround as restricting the management interface, while the advisory says the webmail interface (BleepingComputer, 2026-10-01; NCSC Switzerland, 2026-10-02).
Fortinet's advisory lists attacker addresses and the system events that exploitation left behind: a cron job running a command that references the /migadmin path, an admin CLI session that added a mail archive account sending to a remote host, and IBE decrypter exceptions for invalid Base64 input plus failed internal-user logins (Fortinet PSIRT, 2026-10-01). BleepingComputer reports that Fortinet's advisory also listed files added or modified on compromised appliances, a library added under the data partition, an added ld.so.preload file, a modified system binary, two added binaries, a modified web server configuration and a modified migadmin archive, and reads the archive account as a possible path to send archived data to a remote server (BleepingComputer, 2026-10-01); Fortinet's page carries no such file table, and NCSC Switzerland also lists malicious binaries and modified system files (NCSC Switzerland, 2026-10-02).
Cited evidence
This has been reported to be exploited in the wild, customers are urged to apply the workaround below.
Disable the IBE feature support via the GUI ( Encryption -> IBE -> IBE Service 'off' ) or with the following CLI command:
2026-10-05: Solution update
Disable access to the FortiMail webmail interface from the internet or limit the access only from trusted private network
block POST requests to /ibe that contain '../'
Please note that Fortinet has remediated this issue on oct 05, 2026 in FortiMail Cloud by updating all the firmwares to v7.6.7 GA or v8.0.2 GA, hence the FortiMail Cloud customers need not perform any action.
The incident was caused by the exploitation of a zero-day vulnerability affecting technology provided by our external supplier Fortinet.
Observed attacks deploy malicious binaries and modified system files
Updates3
Belnet, the Belgian government and research network (Risky Bulletin, 2026-09-30), updated its incident notice on 2026-10-02 to say its incident was caused by a zero-day in technology from its supplier Fortinet and to link this advisory for the vulnerability and its CVE, without naming FortiMail (Belnet, 2026-10-02). Belnet says attackers copied all incoming mail to its domains between 2026-07-22 and the morning of 2026-09-25 and that the vulnerability was remediated on 2026-09-25 at 08:10, without saying how (Belnet, 2026-10-02). Read with the advisory, the notice puts exploitation of this flaw about ten weeks before Fortinet's 2026-10-01 disclosure, against a European government network whose loss was bulk inbound mail.
NCSC Switzerland's advisory of 2026-10-02 says observed attacks deploy malicious binaries and modified system files (NCSC Switzerland, 2026-10-02). Fortinet's advisory words its second workaround as disabling access to the FortiMail webmail interface from the internet and adds an option to block POST requests to /ibe that contain '../' at a web application firewall (Fortinet PSIRT, 2026-10-01); BleepingComputer and NCSC Switzerland word the second workaround as the management interface.
Fortinet revised advisory FG-IR-26-175 on 2026-10-05: its timeline now lists a solution update and its solution table names fixed builds for every affected branch, 8.0.2 for 8.0.0 through 8.0.1, 7.6.7 for 7.6.0 through 7.6.6 and 7.4.9 for 7.4.0 through 7.4.8, with FortiMail 7.2.0 through 7.2.9 told to upgrade to branch 7.4 or above (Fortinet PSIRT, 2026-10-01). The advisory's structured record is dated 2026-10-05 and lists 8.0.2, 7.6.7 and 7.4.9 as not affected (Fortinet PSIRT CSAF record, 2026-10-05). The workarounds, the compromise artifacts and the lookback to 2026-07-22 are unchanged, so a workaround remains the interim control for any appliance that cannot be upgraded at once (Fortinet PSIRT, 2026-10-01).
Fortinet's revision of 2026-10-07 adds a FortiMail Cloud clarification to the advisory: Fortinet remediated the issue on 2026-10-05 in FortiMail Cloud by updating all firmware to 7.6.7 or 8.0.2, so FortiMail Cloud customers need not perform any action (Fortinet PSIRT, 2026-10-01). The upgrade and workaround instructions above therefore apply to self-managed appliances; the advisory still shows the flaw as exploited in the wild and its fixed builds, workarounds and compromise artifacts are unchanged (Fortinet PSIRT, 2026-10-01).
Sources8
Revision history
- Published 2026-10-02T0404Z-intel
- Update 2026-10-03T0404Z-intel
Belnet, the Belgian government and research network, says a zero-day in its supplier Fortinet's technology let attackers copy its inbound mail from 2026-07-22 and links this advisory, which puts exploitation about ten weeks before the disclosure. NCSC Switzerland lists the artifacts attackers left. Fortinet's advisory words its workaround as the webmail interface or a web application firewall rule on POST requests to /ibe, where press and NCSC Switzerland say management interface.
Changed: summary immediate_action actions body cves sources evidence verification sourcing_note references
- Update 2026-10-06T0405Z-intel
Fortinet revised FG-IR-26-175 on 2026-10-05 and now names the fixed builds 8.0.2, 7.6.7 and 7.4.9 (7.2 users move to branch 7.4 or above), so the remediation moves from workaround only to upgrade; the workarounds and the compromise artifacts are unchanged.
Changed: title headline summary immediate_action tags cves sources evidence sourcing_note actions body
- Improvement 2026-10-08T0404Z-intel
Fortinet's revision of 2026-10-07 states that it remediated FortiMail Cloud on 2026-10-05 by updating all firmware to 7.6.7 or 8.0.2, so FortiMail Cloud customers need take no action; the upgrade instruction now applies to self-managed appliances. Fixed builds, workarounds and compromise artifacts are unchanged.
Changed: summary immediate_action actions evidence body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.