FortiMail Vulnerability CVE-2026-104286 Exploited: Patch Now

Last updated: 26 October 2026. Sources are listed at the end.

A critical FortiMail vulnerability, CVE-2026-104286, is being exploited in the wild. Fortinet disclosed it on 1 October 2026 in advisory FG-IR-26-175. It lets an attacker who has no login write files anywhere on the appliance. As a result, a single crafted web request can lead to full control of your email gateway.

The bug affects FortiMail 7.2, 7.4, 7.6 and 8.0. CISA added it to its Known Exploited Vulnerabilities (KEV) list on the same day. Fortinet released fixed builds a few days later. So every on-premises appliance can now be patched or moved to a fixed branch.

FortiMail sits in front of your mail server and filters all inbound and outbound mail. Therefore, a compromised box can expose every message and every stored password. If you run one, treat this FortiMail vulnerability as this week’s priority.

The short answer

• Check your firmware with get system status. Anything below 7.4.9, 7.6.7 or 8.0.2 is vulnerable.
• Upgrade now. Fortinet lists no fix for 7.2, so those users must move to 7.4.9 or later.
• If you cannot upgrade today, disable the IBE service and block the web interface from the internet.
• Before upgrading, export logs and a config backup, then search them for Fortinet’s indicators of compromise.
• If you find a match, treat the appliance as breached. Rebuild it and rotate every credential it stored.

What is the FortiMail vulnerability?

Fortinet classifies the flaw as a path traversal (CWE-22) combined with improper handling of NULL bytes (CWE-158). In plain terms, the web interface does not clean up file names in incoming requests. An attacker can therefore add ../ sequences to climb out of the intended folder. A NULL byte then cuts off the rest of the path, so the file lands exactly where the attacker wants.

The flaw sits in the GUI component and needs no authentication or user action. Fortinet rates it 9.8 out of 10. The vendor lists the impact as unauthorised code or command execution. That is because writing the right file to the right place lets the attacker run commands.

Fortinet’s own workaround targets Identity-Based Encryption (IBE). IBE is the feature that lets outside recipients read encrypted mail through a web portal. Also, the advisory tells WAF users to block POST requests to /ibe that contain ../. So the vulnerable path clearly runs through the IBE web endpoint. Field Effect reached the same conclusion in its analysis.

Was a webshell planted?

Fortinet’s advisory does not use the word “webshell”. However, the file indicators reported by BleepingComputer and The Hacker News point to something more persistent. Attackers reportedly added a shared library, /data/lib/liblog.so, and an /data/etc/ld.so.preload file. On Linux, a preload file forces that library into every program that starts. In addition, they dropped two binaries and modified the web server configuration. That is a rootkit-style foothold, not a simple script in a web folder.

Security firm Hard2bit, which studied Fortinet’s downloadable STIX bundle, reported another detail. A root cron job dumped the device configuration into an HTML file under /migadmin/www, then deleted it after 24 hours. That would let attackers fetch the config over the web. We could not confirm this from Fortinet’s page, so treat it as reported.

Timeline and exploitation status

Here is what is confirmed about this FortiMail vulnerability. Fortinet says the flaw is exploited in the wild. CISA lists it in KEV. Gwendal Guégniaud of Fortinet’s Product Security team found it internally. So no outside researcher, such as watchTowr or Rapid7, discovered it. watchTowr has published an FAQ, and its analyst Yordan Ganchev told Cybersecurity Dive the bug is “trivial to exploit”.

However, several things remain unknown. Fortinet has not said who is behind the attacks or how many devices were hit. It also has not said when exploitation began. We found no public proof-of-concept exploit.

Am I affected?

The FortiMail vulnerability affects four on-premises branches. Fortinet’s advisory lists them as follows.

Older branches such as 7.0 are not listed in the advisory. If you still run one, ask Fortinet TAC whether it is affected and plan an upgrade.

To check the version, log in to the CLI over SSH or the console and run the command below. The syntax comes from Fortinet’s CLI reference; we could not run it on a real appliance.

get system status

Look at the Version: line near the top, for example FortiMail-VM v7.6.2, build753. Then compare it with the table.

Next, check whether IBE is switched on. Fortinet’s CLI reference lists the default for this setting as disable. However, many organisations enable it for secure external mail. We have not tested this show command on hardware.

show system encryption ibe

How to fix the FortiMail vulnerability

First, preserve evidence. An upgrade can overwrite files and roll logs, and it does not remove an earlier compromise. Therefore, download a configuration backup and export the event and encryption logs from the GUI before you change anything.

Then upgrade:

1. Download the fixed image for your model from the Fortinet support portal.
2. Read the release notes for the supported upgrade path. Users on 7.2 may need intermediate builds before 7.4.9.
3. Install the image through the GUI or with Fortinet’s documented upgrade procedure.
4. Run get system status again and confirm the new Version: line.

If you cannot upgrade today, apply Fortinet’s workaround. It disables IBE, so external recipients will lose access to encrypted mail until you re-enable it. These commands are taken from Fortinet’s advisory:

config system encryption ibe
    set status disable
end

In the GUI, the same switch is under Encryption, then IBE, then IBE Service. In addition, restrict the webmail and admin interface to trusted internal networks. Fortinet’s advisory mentions the webmail interface, while news reports mention the management interface, so lock down both. Finally, if a WAF sits in front, block POST requests to /ibe containing ../.

How to check if you were already compromised

Patching closes the FortiMail vulnerability, but it does not undo an intrusion. Fortinet published IP addresses and log patterns. Meanwhile, file paths and SHA-256 hashes appear in the IOC table that BleepingComputer and The Hacker News reproduced from Fortinet. Get the hashes from those reports or Fortinet’s STIX bundle; we do not repeat them here.

The archive account deserves special attention. It quietly copies mail to an outside server, which means data theft. So, in the GUI, review your archive accounts and policies for anything you did not create.

Next, search the exported logs and config on a separate Linux machine. First, save the indicators to a file:

cat > fortimail-iocs.txt <<'EOF'
79.141.169.187
45.129.0.192
archive234
/migadmin
Invalid Base64 Encoding at pos 0
liblog.so
ld.so.preload
/data/bin/webconsole
/data/bin/mailservice
EOF

Then run a read-only, fixed-string search over the folder that holds your exports. The -w flag stops partial matches such as a longer IP that merely contains one of these.

grep -r -n -w -F -f fortimail-iocs.txt ./fortimail-exports/

Also check your perimeter firewall and NetFlow logs for any traffic between the FortiMail IP and the two addresses above. The FortiMail CLI does not give you a normal Linux shell, so you cannot list the files directly. Ask Fortinet support (TAC) to check the file indicators and hashes for you.

If you find a match

Treat the appliance as fully compromised. A preload rootkit can survive a simple upgrade, so do not trust the running system. Instead, isolate it, keep the evidence, and work with Fortinet TAC to reinstall from a clean image. Then restore a configuration you have reviewed line by line.

After that, rotate every secret the box held. Because the attackers reportedly dumped the full configuration, assume all of it is known:

• FortiMail admin passwords and any API keys.
• LDAP or Active Directory bind accounts used for recipient lookup.
• SMTP relay and authentication credentials, plus passwords of local mail users.
• TLS certificate private keys installed on the appliance.
• Any shared secrets for RADIUS, archiving destinations or HA peers.

Finally, review admin accounts for anyone you did not create. Then check mail flow for silent forwarding rules.

The India angle

We did not find a CERT-In advisory specific to this CVE as of 26 October 2026. Even so, the CERT-In Directions of April 2022 still apply. Covered entities must report a confirmed compromise of an email server to CERT-In within six hours of noticing it.

Mail gateways also process personal data. Under DPDP Rule 7, a breach needs a notice and, within 72 hours, a detailed report to the Data Protection Board. However, that rule applies only from May 2027 and is not yet in force. It is still wise to document what you find now.

This is the second Fortinet story on our site this month. Our post on the k0t VPN credentials leak covers attacks on FortiGate and FortiWeb. If you run several Fortinet products, review them together.

Quick checklist

• ☐ Run get system status on every FortiMail and record the version.
• ☐ Export logs and a config backup before changing anything.
• ☐ Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later; move 7.2 to 7.4.9 or later.
• ☐ If upgrade must wait, disable IBE and block internet access to webmail and admin pages.
• ☐ Search logs for the two IPs, archive234, /migadmin and the Base64 error.
• ☐ Review archive accounts, admin accounts and forwarding rules.
• ☐ Ask Fortinet TAC to check the file IOCs and hashes.
• ☐ On any match, rebuild from a clean image and rotate every stored credential.
• ☐ Report to CERT-In within six hours if you are a covered entity.

Finally, remember that edge appliances like mail gateways are now a favourite way in for attackers. If you want a second pair of eyes, our VAPT services test exactly these internet-facing systems. You can also start with the free website safety check on our home page.

Sources

• Fortinet PSIRT advisory FG-IR-26-175
• BleepingComputer: Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
• The Hacker News: Critical FortiMail zero-day flaw
• Help Net Security: Critical FortiMail zero-day exploited in the wild
• watchTowr: FortiMail CVE-2026-104286 FAQ
• Cybersecurity Dive: Fortinet critical flaw in FortiMail under exploitation
• Hard2bit: FortiMail zero-day patch status and IoCs
• Fortinet FortiMail CLI reference: get system status

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.