FortiMail CVE-2026-104286: exploited critical flaw now has fixes — check for compromise before updating

If your company runs a FortiMail — Fortinet's email gateway that filters spam, phishing and malware before messages reach inboxes — this is one of those alerts that can't wait for the next maintenance window. The flaw CVE-2026-104286, rated CVSS 9.8, lets someone without a login write arbitrary files on the appliance, and Fortinet itself confirms it is already being exploited.

The good news is that fixed versions have been available since October 5. The less good news is that updating isn't enough: if the appliance was breached before the patch, whatever the attacker left inside is still there. Below is what we know, who is affected and the right order to do things.

What the flaw is

According to advisory FG-IR-26-175, published on October 1, 2026, it combines two weaknesses: path traversal (CWE-22) and improper neutralization of a NULL byte (CWE-158). In practice, crafted HTTP or HTTPS requests can write files outside the directory the web service is supposed to write to. Fortinet rates the impact as "execute unauthorized code or commands" and marks the issue as known exploited.

The vulnerable component is tied to IBE (Identity Based Encryption), the FortiMail feature that lets recipients outside the company open encrypted email through a web portal. Because IBE only works if that portal is reachable from the internet, many appliances are exposed by design.

The flaw was found internally by Gwendal Guégniaud of Fortinet's Product Security team. Fortinet has not said who is behind the attacks, when they started or how many customers were hit.

The US agency CISA added the CVE to its KEV (Known Exploited Vulnerabilities) catalog the same day, with an October 4 deadline for federal agencies, and flagged the entry as requiring forensic triage under directive BOD 26-04 — in other words, patching isn't enough; you have to check whether you were breached. We covered that directive in the Ivanti Sentry case.

Which versions are affected

Three things to watch:

• FortiMail Cloud was already fixed by Fortinet on October 5 (all firmware moved to 7.6.7 or 8.0.2). Cloud customers don't need to do anything.
• The 7.2 branch will not get a fix. Anyone on it must plan a migration to 7.4.9 or later — and 7.4 builds before 7.4.9 are vulnerable too.
• ThreatFrontier noted that the record Fortinet filed with NVD also lists FortiMail 7.0.0 to 7.0.9, even though the advisory's table doesn't mention the 7.0 branch. If you still run 7.0, treat the appliance as exposed.

If you can't update yet: the official mitigation

Until you can update, Fortinet gives three options, from strongest to most limited:

1. Turn off IBE if the company can live without it: in the GUI, under Encryption → IBE → IBE Service, set it to "off". From the CLI, the advisory gives the block config system encryption ibe / set status disable / end.
2. Take the FortiMail webmail off the internet, or allow access only from trusted private networks.
3. If a WAF (web application firewall) sits in front of FortiMail, block the POST requests Fortinet describes in the advisory.

This lowers the risk going forward, but it doesn't undo a breach that already happened.

Check for compromise before you update

This is the step many teams skip. The update fixes the flaw, but it doesn't remove files, accounts or scheduled tasks an attacker may have created. So the recommended order is: mitigate → investigate → update.

Fortinet published indicators of compromise in the advisory itself: two source IP addresses and log patterns to look for. We don't reproduce the indicators here — always use the latest version of the official advisory. Broadly, the signs described include:

• scheduled (cron) tasks running as root that you don't recognize;
• administrator logout records from a "(null)" source;
• an archive account configured to send copies to an unknown remote server;
• decoding errors in the encryption logs and failed login attempts by internal users.

The archive account is the most serious item for most companies. An email gateway sees every message; a malicious archive rule means quiet, ongoing email theft. According to ThreatFrontier, the original version of the advisory also listed added or modified system files (with hashes), a list that was later removed from the page.

If you find any indicator:

• treat the appliance as compromised;
• preserve logs and disk before touching anything;
• rebuild from a clean image rather than just deleting suspicious files;
• change administrator passwords and any keys or certificates stored on the device;
• assume archived email may have been read and assess your notification obligations.

Why this matters for SMBs

Email gateways, VPNs and edge appliances have become favorite targets because they face the internet, have privileged access and rarely get monitored like a regular server. We saw the same pattern recently with the SonicWall SMA1000. In Japan, the JPCERT/CC and IPA alerts about the data-breach wave also list "known vulnerabilities in exposed equipment" among the first things to check.

For small companies, the risk usually sits in three places: the appliance "a vendor installed" that nobody remembers anymore; the old branch (7.2 or 7.0) nobody wants to migrate; and the lack of anyone watching the logs. A compromised FortiMail can also be used to send phishing that looks legitimate, since it comes from the company's official server.

Quick checklist

• List every FortiMail in the company, including branches, DMZ and test environments, with each one's version.
• If any runs an affected version, apply the mitigation (turn off IBE or close the webmail) today.
• Look for the official advisory's indicators in the logs and review every archive and forwarding rule.
• No indicators: update to 8.0.2, 7.6.7 or 7.4.9 (or later).
• Indicators found: isolate, preserve evidence, rebuild and rotate credentials.
• On 7.2 (or 7.0): schedule the move to 7.4.9+ and keep the mitigation until then.
• On FortiMail Cloud? Confirm with your provider or partner, but Fortinet says no action is needed.

What we still don't know

Fortinet hasn't disclosed the number of victims, the origin of the attacks or technical details of the malicious request — and there's no reason to go looking for them: what matters to defenders is the version, the mitigation and the investigation. We'll follow updates to the advisory and the KEV catalog and update this article if anything relevant changes.

Sources

• Fortinet PSIRT: FG-IR-26-175 — FortiMail (CVE-2026-104286)
• CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-104286)
• NVD: CVE-2026-104286
• Help Net Security: Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)
• CIS / MS-ISAC Advisory 2026-108: A Vulnerability in Fortinet FortiMail Could Allow for Arbitrary Code Execution
• ThreatFrontier: Exploited FortiMail Flaw Now Patched — Check for Compromise First

---

Want this for your business?

KGA IT helps small and medium-sized businesses set up AI assistants, automation and websites. The consultation is free and we reply within 24 hours. Plans start at ¥5,000/month.

• Phone: 080-9732-1062
• Email: kga-it@outlook.com
• Contact page: kga-it.com/en/contact