FortiMail CVE-2026-104286: Exploited Pre-Auth File Write

What to do

1. List every FortiMail appliance and VM and check its firmware with get system status.
2. Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later; move 7.2 systems to 7.4.9 or later.
3. If you cannot upgrade today, disable the IBE service (config system encryption ibe, set status disable, end) or remove internet access to the webmail interface.
4. With a WAF in front of FortiMail, block POST requests to /ibe that contain '../' until patched.
5. Hunt for Fortinet's indicators before and after upgrading, because upgrading does not remove anything an attacker already planted.
6. If you find indicators, treat the appliance as compromised: preserve logs, engage Fortinet support, rebuild, and rotate admin passwords and any credentials stored on the device.

How to check if you are affected or compromised

• Search firewall and FortiMail logs for traffic to or from 79.141.169.187 and 45.129.0.192.
• Look for a cron system event running /bin/sh -c with O=/migadmin, and an admin logout with reason=unknown.
• Check the config log for an archive account named 'archive234' with a remote destination of 79.141.169.187 and directory /uploads.
• Look in encryption logs for IBE DecrypterMediaIn BufferException errors ('Invalid Base64 Encoding at pos 0. Character=0x2a').
• Review web or WAF logs for POST requests to /ibe containing '../'.

What happened#

On October 1, 2026, Fortinet published FG-IR-26-175 for CVE-2026-104286, a critical flaw in FortiMail, its email security gateway. A path traversal (CWE-22) and improper handling of NULL bytes (CWE-158) let an unauthenticated attacker "write arbitrary files on the underlying system via crafted HTTP or HTTPS requests." Fortinet rates it CVSS 3.1 9.8 and lists the impact as executing unauthorized code or commands. The advisory says the issue "has been reported to be exploited in the wild."

Fortinet's product security team found the bug internally. The workaround points at the Identity-Based Encryption (IBE) web feature. CISA added the CVE to the KEV catalog the same day and gave federal agencies until October 4.

The flaw shipped as a zero-day. When SecurityWeek and Help Net Security reported on October 2, no fixed builds were out, only the workaround. Fortinet updated the advisory with fixed releases on October 5 and clarified the FortiMail Cloud status on October 7.

Who is affected#

Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. The fixes are 8.0.2, 7.6.7 and 7.4.9. The 7.2 branch gets no fix, and Fortinet tells those users to upgrade to 7.4 or later. Fortinet updated FortiMail Cloud to 7.6.7 or 8.0.2 on October 5, so cloud customers have nothing to do. The machine-readable product list in the CVE record also includes 7.0.x builds, which the advisory table and description do not mention. If you still run 7.0, treat it as exposed and move to a supported branch.

Do you really need to act?#

Yes, if you run FortiMail yourself. A mail gateway is internet-facing by design. Its webmail and IBE pages are commonly reachable from the internet so that outside recipients can retrieve encrypted mail. The bug needs no credentials, is under active exploitation, and gives an attacker a write primitive on an appliance that sees all of your inbound and outbound mail. CISA's enrichment on the CVE record marks it automatable with total technical impact.

Fortinet's indicators suggest what attackers do next. They show an archive account named archive234 configured to ship archives to a remote server at 79.141.169.187. That suggests mail theft, not just a foothold. Fortinet has not said when exploitation began, how many devices were hit, or who is behind it.

FortiMail Cloud customers and organizations without FortiMail can relax.

What to do now#

1. Check the firmware on every appliance and VM with get system status.
2. Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later. Move 7.2 (and any 7.0) systems to 7.4.9 or later.
3. If you cannot upgrade today, disable IBE in the GUI (Encryption > IBE > IBE Service off) or from the CLI: config system encryption ibe, set status disable, end. Alternatively, block internet access to the webmail interface and allow only trusted private networks.
4. If a WAF sits in front of FortiMail, block POST requests to /ibe that contain ../.
5. Check the indicators below before and after upgrading. A patch blocks new exploitation but does not remove existing persistence or configuration changes.

How to tell if you were hit#

Fortinet lists these indicators:

• The IPs 79.141.169.187 and 45.129.0.192.
• A system event log entry with ui=cron whose command starts /bin/sh -c 'O=/migadmin.
• An admin logout with reason=unknown from (null).
• A config log entry adding an archive account archive234 with remote-ip[79.141.169.187] and remote-directory[/uploads].
• IBE encryption-log errors reading Invalid Base64 Encoding at pos 0. Character=0x2a, alongside Internal user <address> failed to log in entries.

Also search web and WAF logs for POSTs to /ibe with traversal sequences. If anything matches, assume compromise. Preserve logs and a configuration backup, open a case with Fortinet, rebuild the appliance from clean firmware, and rotate admin passwords, LDAP or directory bind credentials, and other secrets stored on it. Review whether archived mail was sent off-box.

Timeline#

• Oct 1, 2026 — Fortinet publishes FG-IR-26-175 as an exploited zero-day with a workaround only. CISA adds it to KEV, with a federal deadline of October 4.
• Oct 2, 2026 — Press coverage notes that fixed builds 8.0.2, 7.6.7 and 7.4.9 are not yet released.
• Oct 5, 2026 — Fortinet updates the advisory with fixed releases and patches FortiMail Cloud.
• Oct 7, 2026 — The advisory and CVE record are updated with the FortiMail Cloud clarification (NVD).

Vulnerability records

• CVE-2026-104286 · KEV 2026-10-01 · An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Fortinet PSIRT — FG-IR-26-175: FortiMail improper limitation of a pathname to a restricted directory fortiguard.fortinet.com
2. CVE record — CVE-2026-104286 cve.org
3. NVD — CVE-2026-104286 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-104286 cisa.gov

Coverage and analysis

1. Help Net Security — Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) helpnetsecurity.com
2. SecurityWeek — Exploited Fortinet FortiMail zero-day calls for urgent action securityweek.com