---
schema: 1
kind: vulnerability
title: "CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)"
headline: "Fortinet now names fixed FortiMail builds for an unauthenticated file-write flaw it confirmed exploited as a zero-day"
summary: >
  Fortinet's advisory FG-IR-26-175 of 2026-10-01 describes a path traversal in FortiMail that lets an unauthenticated
  attacker write arbitrary files through crafted HTTP or HTTPS requests, and says it has been reported exploited in
  the wild; CISA listed it in KEV the same day. Belnet, the Belgian government and research network, says a zero-day in its
  supplier Fortinet's technology let attackers copy its inbound mail from 2026-07-22 and links this advisory, which puts
  exploitation about ten weeks before the disclosure. Fortinet's revision of 2026-10-05 names the fixed builds 8.0.2,
  7.6.7 and 7.4.9 and tells 7.2 users to move to branch 7.4 or above; the vendor workarounds remain the interim control. Fortinet says it remediated FortiMail Cloud on 2026-10-05, so
  only self-managed appliances need action.
discovered_at: "2026-10-02T04:44:00Z"
updated_at: "2026-10-06T04:59:00Z"
event_date: "2026-10-01"
run_id: 2026-10-02T0404Z-intel
priority: critical
immediate_action:
  title: "Upgrade every self-managed FortiMail to a fixed build now: the zero-day is exploited and fixes have shipped"
  action: >
    Fortinet reports in-the-wild exploitation of an unauthenticated file-write flaw in FortiMail and, since 2026-10-05,
    names the fixed builds 8.0.2, 7.6.7 and 7.4.9 (7.2 moves to branch 7.4 or above). Upgrade every self-managed appliance now (FortiMail Cloud was remediated by Fortinet on 2026-10-05); where the upgrade has
    to wait, disable IBE support with the vendor's CLI command, or cut the FortiMail webmail interface off from the
    internet, or block POST requests to /ibe that contain '../' at a web application firewall in front of FortiMail.
    Then check every appliance that was reachable against the compromise artifacts in advisory FG-IR-26-175, looking
    back to at least 2026-07-22.
tags: [vulnerabilities, path-traversal, pre-auth, actively-exploited, cisa-kev, patch-available]
regions: [global]
sectors: [public-sector, technology]
entities: ["product:fortinet-fortimail"]
techniques: [T1190, T1574.006, T1053.003, T1554, T1114]
affected_products: ["Fortinet FortiMail"]
cves:
  - id: CVE-2026-104286
    cvss: "9.8"
    epss: null
    type: path-traversal
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "FortiMail 8.0.0 through 8.0.1; 7.6.0 through 7.6.6; 7.4.0 through 7.4.8; 7.2.0 through 7.2.9"
    fixed: "8.0.2 (8.0.0 through 8.0.1), 7.6.7 (7.6.0 through 7.6.6), 7.4.9 (7.4.0 through 7.4.8); FortiMail 7.2.0 through 7.2.9: upgrade to branch 7.4 or above"
sources:
  - url: "https://www.fortiguard.com/psirt/FG-IR-26-175"
    publisher: "Fortinet PSIRT (FG-IR-26-175)"
    date: "2026-10-01"
    role: primary
  - url: "https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/"
    publisher: "BleepingComputer"
    date: "2026-10-01"
    role: corroborating
  - url: "https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog"
    publisher: "CISA"
    date: "2026-10-01"
    role: corroborating
  - url: "https://www.belnet.be/en/news-events/news/security-and-privacy-incident-affecting-belnets-it-infrastructure"
    publisher: "Belnet"
    date: "2026-10-02"
    role: corroborating
  - url: "https://security-hub.ncsc.admin.ch/#/posts/13027"
    publisher: "NCSC Switzerland (Cyber Security Hub)"
    date: "2026-10-02"
    role: corroborating
  - url: "https://advisories.ncsc.nl/2026/ncsc-2026-0398.html"
    publisher: "NCSC-NL"
    date: "2026-10-02"
    role: corroborating
  - url: "https://news.risky.biz/risky-bulletin-sanctions-force-cas-to-revoke-tls-certs-in-iran-russia/"
    publisher: "Risky Bulletin"
    date: "2026-09-30"
    role: corroborating
  - url: "https://filestore.fortinet.com/fortiguard/psirt/csaf_improper-limitation-of-a-pathname-to-a-restricted-directory_fg-ir-26-175.json"
    publisher: "Fortinet PSIRT (FG-IR-26-175 CSAF record)"
    date: "2026-10-05"
    role: corroborating
closed_sources: []
evidence:
  - quote: "This has been reported to be exploited in the wild, customers are urged to apply the workaround below."
    publisher: "Fortinet PSIRT (FG-IR-26-175)"
    source_url: "https://www.fortiguard.com/psirt/FG-IR-26-175"
  - quote: "Disable the IBE feature support via the GUI ( Encryption -> IBE -> IBE Service 'off' ) or with the following CLI command:"
    publisher: "Fortinet PSIRT (FG-IR-26-175)"
    source_url: "https://www.fortiguard.com/psirt/FG-IR-26-175"
  - quote: "2026-10-05: Solution update"
    publisher: "Fortinet PSIRT (FG-IR-26-175)"
    source_url: "https://www.fortiguard.com/psirt/FG-IR-26-175"
  - quote: "Disable access to the FortiMail webmail interface from the internet or limit the access only from trusted private network"
    publisher: "Fortinet PSIRT (FG-IR-26-175)"
    source_url: "https://www.fortiguard.com/psirt/FG-IR-26-175"
  - quote: "block POST requests to /ibe that contain '../'"
    publisher: "Fortinet PSIRT (FG-IR-26-175)"
    source_url: "https://www.fortiguard.com/psirt/FG-IR-26-175"
  - quote: "Please note that Fortinet has remediated this issue on oct 05, 2026 in FortiMail Cloud by updating all the firmwares to v7.6.7 GA or v8.0.2 GA, hence the FortiMail Cloud customers need not perform any action."
    publisher: "Fortinet PSIRT (FG-IR-26-175)"
    source_url: "https://www.fortiguard.com/psirt/FG-IR-26-175"
  - quote: "The incident was caused by the exploitation of a zero-day vulnerability affecting technology provided by our external supplier Fortinet."
    publisher: "Belnet"
    source_url: "https://www.belnet.be/en/news-events/news/security-and-privacy-incident-affecting-belnets-it-infrastructure"
  - quote: "Observed attacks deploy malicious binaries and modified system files"
    publisher: "NCSC Switzerland (Cyber Security Hub)"
    source_url: "https://security-hub.ncsc.admin.ch/#/posts/13027"
verification: multi-source
sourcing_note: >
  The exploitation statement is Fortinet's own; CISA's KEV listing relies on it. Belnet, a victim, separately reports a
  zero-day in Fortinet technology and links this advisory without naming FortiMail, and the 2026-07-22 start date is
  Belnet's. Fortinet gives no actor, victim count or first-exploitation date, and BleepingComputer states Fortinet
  declined to say more. NCSC Switzerland and NCSC-NL restate the advisory, and Fortinet's own revision of 2026-10-05 names the fixed builds.
confidence: high
references:
  - 2026-10-02/belnet-supplier-zero-day-mail-copied-65-days
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade every self-managed FortiMail to the fixed build for its branch (8.0.2, 7.6.7 or 7.4.9; 7.2 moves to branch 7.4 or above, which means 7.4.9 or later; FortiMail Cloud customers need not act); until each appliance is upgraded, disable IBE support (config system encryption ibe, set status disable) or, as Fortinet's alternatives, cut the webmail interface off from the internet or block POST requests to /ibe containing '../' at a web application firewall in front of it."
  - "Check every FortiMail that was internet-reachable before the workaround against the cron, CLI-audit and log artifacts in FG-IR-26-175 and the file artifacts that BleepingComputer and NCSC Switzerland describe, looking back to at least 2026-07-22, including a mail archive account that sends to a remote host and mail copied to destinations outside the organization."
updates:
  - at: "2026-10-03T04:55:00Z"
    run_id: 2026-10-03T0404Z-intel
    type: update
    summary: >
      Belnet, the Belgian government and research network, says a zero-day in its supplier Fortinet's technology let
      attackers copy its inbound mail from 2026-07-22 and links this advisory, which puts exploitation about ten weeks
      before the disclosure. NCSC Switzerland lists the artifacts attackers left. Fortinet's advisory words its
      workaround as the webmail interface or a web application firewall rule on POST requests to /ibe, where press
      and NCSC Switzerland say management interface.
    fields: [summary, immediate_action, actions, body, cves, sources, evidence, verification, sourcing_note, references]
  - at: "2026-10-06T04:59:00Z"
    run_id: 2026-10-06T0405Z-intel
    type: update
    summary: >
      Fortinet revised FG-IR-26-175 on 2026-10-05 and now names the fixed builds 8.0.2, 7.6.7 and 7.4.9 (7.2 users move
      to branch 7.4 or above), so the remediation moves from workaround only to upgrade; the workarounds and the compromise
      artifacts are unchanged.
    fields: [title, headline, summary, immediate_action, tags, cves, sources, evidence, sourcing_note, actions, body]
  - at: "2026-10-08T04:59:39Z"
    run_id: 2026-10-08T0404Z-intel
    type: improvement
    summary: >
      Fortinet's revision of 2026-10-07 states that it remediated FortiMail Cloud on 2026-10-05 by updating all firmware
      to 7.6.7 or 8.0.2, so FortiMail Cloud customers need take no action; the upgrade instruction now applies to
      self-managed appliances. Fixed builds, workarounds and compromise artifacts are unchanged.
    fields: [summary, immediate_action, actions, evidence, body]
migrated_from: null
---

Fortinet published advisory FG-IR-26-175 on 2026-10-01 for CVE-2026-104286, a path traversal combined with improper neutralization of a NULL byte in FortiMail that may let an unauthenticated attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). Fortinet says the flaw "has been reported to be exploited in the wild" ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)), its own product-security team found it, and BleepingComputer reports a CVSS score of 9.8 and describes the flaw as affecting the management interface ([BleepingComputer, 2026-10-01](https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/)). CISA added the CVE to its KEV catalog on 2026-10-01 ([CISA, 2026-10-01](https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog)). Fortinet names no actor, victim count or date of first exploitation; Belnet's account, described below, supplies a date and one victim.

Affected are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9; Fortinet's revision of 2026-10-05 names 8.0.2, 7.6.7 and 7.4.9 as the fixed builds and tells 7.2 users to move to branch 7.4 or above, which means 7.4.9 or later because 7.4.0 through 7.4.8 are affected ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). Fortinet lists three workarounds: disable IBE feature support in the GUI or with a CLI command; alternatively disable access to the FortiMail webmail interface from the internet or limit it to a trusted private network; or, where a web application firewall sits in front of FortiMail, block POST requests to /ibe that contain '../' ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). BleepingComputer (2026-10-01) and NCSC Switzerland (2026-10-02) word the second workaround as restricting the management interface, while the advisory says the webmail interface ([BleepingComputer, 2026-10-01](https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/); [NCSC Switzerland, 2026-10-02](https://security-hub.ncsc.admin.ch/#/posts/13027)).

Fortinet's advisory lists attacker addresses and the system events that exploitation left behind: a cron job running a command that references the /migadmin path, an admin CLI session that added a mail archive account sending to a remote host, and IBE decrypter exceptions for invalid Base64 input plus failed internal-user logins ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). BleepingComputer reports that Fortinet's advisory also listed files added or modified on compromised appliances, a library added under the data partition, an added `ld.so.preload` file, a modified system binary, two added binaries, a modified web server configuration and a modified migadmin archive, and reads the archive account as a possible path to send archived data to a remote server ([BleepingComputer, 2026-10-01](https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/)); Fortinet's page carries no such file table, and NCSC Switzerland also lists malicious binaries and modified system files ([NCSC Switzerland, 2026-10-02](https://security-hub.ncsc.admin.ch/#/posts/13027)).

**Exposure:** every FortiMail on the four listed branches; Fortinet's workarounds point to the IBE feature, the webmail interface and the /ibe request path as the reachable surface, so whether IBE is enabled and whether the webmail interface is reachable from the internet is the first check ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). FortiMail Cloud customers need take no action, because Fortinet updated all FortiMail Cloud firmware to 7.6.7 or 8.0.2 on 2026-10-05 ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). NCSC-NL reads the affected builds as those with IBE enabled, a condition Fortinet's table does not state, and says Fortinet released security updates ([NCSC-NL, 2026-10-02](https://advisories.ncsc.nl/2026/ncsc-2026-0398.html)).

**Detection:** appliance admin and CLI audit events (a configuration change from the CLI adding an archive account whose destination is a remote host), system-event entries for a cron job running a command that references the /migadmin path, IBE decrypter exceptions for invalid Base64 input, and a file-integrity comparison of the data partition against a known-good image for the added library, the `ld.so.preload` entry and the modified binary and web server configuration; Fortinet's advisory lists the log patterns, and BleepingComputer reproduces the file list it attributes to Fortinet ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175); [BleepingComputer, 2026-10-01](https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/)). Because Belnet's notice dates the copying of mail from 2026-07-22, the review should reach back to at least that date and should include mail flow copied to destinations outside the organization ([Belnet, 2026-10-02](https://www.belnet.be/en/news-events/news/security-and-privacy-incident-affecting-belnets-it-infrastructure)).

**Defender takeaway:** upgrade every self-managed FortiMail to the fixed build for its branch now (8.0.2, 7.6.7, or 7.4.9 or later, with 7.2 moving to 7.4.9 or later) and apply a workaround until each upgrade lands, then check each appliance that was reachable before the fix for Fortinet's artifacts, back to at least 2026-07-22.

## Update — 2026-10-03T04:55:00Z

Belnet, the Belgian government and research network ([Risky Bulletin, 2026-09-30](https://news.risky.biz/risky-bulletin-sanctions-force-cas-to-revoke-tls-certs-in-iran-russia/)), updated its incident notice on 2026-10-02 to say its incident was caused by a zero-day in technology from its supplier Fortinet and to link this advisory for the vulnerability and its CVE, without naming FortiMail ([Belnet, 2026-10-02](https://www.belnet.be/en/news-events/news/security-and-privacy-incident-affecting-belnets-it-infrastructure)). Belnet says attackers copied all incoming mail to its domains between 2026-07-22 and the morning of 2026-09-25 and that the vulnerability was remediated on 2026-09-25 at 08:10, without saying how ([Belnet, 2026-10-02](https://www.belnet.be/en/news-events/news/security-and-privacy-incident-affecting-belnets-it-infrastructure)). Read with the advisory, the notice puts exploitation of this flaw about ten weeks before Fortinet's 2026-10-01 disclosure, against a European government network whose loss was bulk inbound mail.

NCSC Switzerland's advisory of 2026-10-02 says observed attacks deploy malicious binaries and modified system files ([NCSC Switzerland, 2026-10-02](https://security-hub.ncsc.admin.ch/#/posts/13027)). Fortinet's advisory words its second workaround as disabling access to the FortiMail webmail interface from the internet and adds an option to block POST requests to /ibe that contain '../' at a web application firewall ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)); BleepingComputer and NCSC Switzerland word the second workaround as the management interface. 

## Update — 2026-10-06T04:59:00Z

Fortinet revised advisory FG-IR-26-175 on 2026-10-05: its timeline now lists a solution update and its solution table names fixed builds for every affected branch, 8.0.2 for 8.0.0 through 8.0.1, 7.6.7 for 7.6.0 through 7.6.6 and 7.4.9 for 7.4.0 through 7.4.8, with FortiMail 7.2.0 through 7.2.9 told to upgrade to branch 7.4 or above ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). The advisory's structured record is dated 2026-10-05 and lists 8.0.2, 7.6.7 and 7.4.9 as not affected ([Fortinet PSIRT CSAF record, 2026-10-05](https://filestore.fortinet.com/fortiguard/psirt/csaf_improper-limitation-of-a-pathname-to-a-restricted-directory_fg-ir-26-175.json)). The workarounds, the compromise artifacts and the lookback to 2026-07-22 are unchanged, so a workaround remains the interim control for any appliance that cannot be upgraded at once ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)).

## Improvement — 2026-10-08T04:59:39Z

Fortinet's revision of 2026-10-07 adds a FortiMail Cloud clarification to the advisory: Fortinet remediated the issue on 2026-10-05 in FortiMail Cloud by updating all firmware to 7.6.7 or 8.0.2, so FortiMail Cloud customers need not perform any action ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)). The upgrade and workaround instructions above therefore apply to self-managed appliances; the advisory still shows the flaw as exploited in the wild and its fixed builds, workarounds and compromise artifacts are unchanged ([Fortinet PSIRT, 2026-10-01](https://www.fortiguard.com/psirt/FG-IR-26-175)).