The short answer
CVE-2026-104286 lets an attacker with no credentials write files onto a Fortinet FortiMail appliance, and it is being exploited now. Fortinet published advisory FG-IR-26-175 on October 1, 2026 and confirmed attacks in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.
FortiMail sits in front of corporate mailboxes and sees every inbound and outbound message, so control of it is control of a company’s email flow. If you run it, upgrade to a fixed release, take the admin interface off untrusted networks and check for signs of intrusion. Mail gateways belong in the scope of every penetration test and security audit, yet they are often left out.
What did Fortinet disclose?
On October 1, 2026, Fortinet published FG-IR-26-175 for CVE-2026-104286 in FortiMail, its secure email gateway. Two weaknesses combine: the appliance does not properly limit file paths to the directory they belong in, and it mishandles null bytes in requests. Together they let a remote attacker who has not logged in send crafted HTTP or HTTPS requests that write files to arbitrary locations on the system. Fortinet rates the issue 9.8 out of 10.
Fortinet says it has seen the flaw exploited and lists indicators of compromise: changed or added files among system libraries and binaries, traffic from addresses including 79.141.169.187 and 45.129.0.192, and log entries showing unauthorized access and configuration changes. The advisory names disabling the Identity-Based Encryption (IBE) feature as a workaround, which suggests the vulnerable code path is tied to IBE. CISA added the CVE to its KEV catalog on the same day, warning that this class of bug is a frequent attack vector against federal networks.
Why is a file-write bug on a mail gateway so dangerous?
Arbitrary file write on a network appliance rarely stays a file-write problem. An attacker who can drop files into system library or binary paths can usually turn that into code execution, persistence that survives reboots, or a modified configuration. Fortinet’s own indicators point to exactly that: tampered libraries and binaries, not just stray files.
The target makes it worse. A secure email gateway inspects, filters and sometimes encrypts every message that enters or leaves the company. With control of it, an attacker can read mail in transit, harvest password-reset links and invoices, relay phishing from a trusted domain or quietly weaken filtering. Fortinet edge devices have been a steady target for years, and many companies patch them less often than the applications behind them.
What it means for US & EU software teams
First, email infrastructure is part of your application security perimeter. Sign-up confirmations, password resets, magic links and invoice notifications all pass through the mail path. If the gateway is compromised, an attacker can intercept those messages and take over user or admin accounts in your product without touching your code. Threat models for customer-facing apps should include the mail relay, not stop at the API.
Second, appliance patching needs the same discipline as application releases. Edge devices are often updated by hand when someone reads an advisory. That leaves days or weeks of exposure on exactly the systems attackers scan for first. An owner, an inventory with exact firmware versions and a tested upgrade runbook are what make a same-day response possible.
Third, patched does not mean clean. Because exploitation preceded the advisory, an appliance may have been altered before you upgraded. For EU organizations a compromised mail gateway can trigger a GDPR breach assessment, NIS2 incident reporting and, for financial entities, DORA ICT-incident rules. US companies under SOC 2, HIPAA or PCI DSS will be asked by auditors and customers to show that they checked, not only that they patched.
What should you do now?
- Inventory every FortiMail. List all appliances and virtual instances, including DR and lab units, with their exact version. Anything in 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 or 7.2.x is affected.
- Preserve evidence, then upgrade. Export logs and back up the configuration first. Then move to 8.0.2, 7.6.7 or 7.4.9 or later; 7.2 units have to migrate to a fixed 7.4 release. Confirm the fixed build is available for your branch in the Fortinet support portal.
- Cut exposure until you can patch. Restrict the management interface to trusted private networks and disable IBE if you do not use it, as Fortinet advises. These are stopgaps, not fixes.
- Hunt for indicators. Check system libraries and binaries for unexpected changes, search logs for unauthorized logins and configuration changes, and look for connections from the IP addresses listed in FG-IR-26-175.
- Rotate and review. If anything looks wrong, rotate admin credentials and keys, review mail-flow and relay rules for changes, and rebuild the appliance from a clean image rather than trusting an in-place upgrade.
Frequently asked questions
What is CVE-2026-104286?
CVE-2026-104286 is a critical vulnerability in Fortinet FortiMail, the company's email security gateway. It combines a path traversal flaw (CWE-22) with improper handling of null bytes (CWE-158), and lets an unauthenticated remote attacker write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. Fortinet rates it CVSS 9.8 and published advisory FG-IR-26-175 on October 1, 2026.
Is CVE-2026-104286 being exploited?
Yes. Fortinet states that it has observed the vulnerability exploited in the wild, and CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on October 1, 2026. Under CISA's binding operational directives, US federal civilian agencies must remediate KEV entries on a short deadline, and private companies should treat the listing as a signal to patch as an emergency change.
Which FortiMail versions are affected and which fix it?
Affected releases are FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. Fortinet's advisory lists 8.0.2, 7.6.7 and 7.4.9 or later as fixed. The 7.2 branch gets no fix of its own, so those appliances must move to a fixed 7.4 release. Some early reports said fixed builds were not yet available for every branch at publication, so confirm availability in the Fortinet support portal.
What can we do if we cannot upgrade immediately?
Fortinet's advisory lists two workarounds: disable the Identity-Based Encryption (IBE) feature if you do not use it, and restrict access to the management interface to trusted private networks. Both reduce exposure but do not remove the flaw, so plan the upgrade as soon as a fixed build is available for your branch.
How do we check whether our FortiMail was compromised?
Fortinet published indicators of compromise in FG-IR-26-175: unexpected modified or added files among system libraries and binaries, connections from IP addresses including 79.141.169.187 and 45.129.0.192, and log entries showing unauthorized access and configuration changes. Preserve logs and a configuration backup before upgrading, compare system files against a clean image where possible, and rotate admin credentials if anything looks wrong.
Sources
Fortinet PSIRT — FG-IR-26-175: FortiMail path traversal (CVE-2026-104286)
CISA — CISA Adds One Known Exploited Vulnerability to Catalog (October 1, 2026)
runZero — Fortinet FortiMail CVE-2026-104286: Find impacted appliances