---
title: "FortiMail CVE-2026-104286: Exploited Pre-Auth File Write"
url: https://erroneo.us/security/briefs/fortimail-ibe-path-traversal-cve-2026-104286/
description: "Exploited FortiMail zero-day lets unauthenticated attackers write files via the IBE web interface. Fixed in 8.0.2, 7.6.7, 7.4.9. Patch now and check the IOCs."
type: security-brief
section: "Security Digest"
date_published: 2026-10-01
date_modified: 2026-10-07
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-104286"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiMail CVE-2026-104286: Exploited Pre-Auth File Write

**Verdict: Act now.** If you run a self-managed FortiMail, upgrade today and check Fortinet's indicators; this is an unauthenticated file-write zero-day on an internet-facing mail gateway.

- **Who must act:** Anyone running FortiMail 7.2, 7.4, 7.6 or 8.0 as an appliance or VM, most urgently where the webmail or IBE interface is reachable from the internet.
- **Who can relax:** FortiMail Cloud customers, whom Fortinet patched on Oct 5, 2026, and organizations that do not run FortiMail.
- **Affected:** FortiMail 8.0.0 through 8.0.1; FortiMail 7.6.0 through 7.6.6; FortiMail 7.4.0 through 7.4.8; FortiMail 7.2.0 through 7.2.9 (no fix on this branch)
- **Fixed:** FortiMail 8.0.2; FortiMail 7.6.7; FortiMail 7.4.9; FortiMail 7.2: upgrade to 7.4.9 or later; FortiMail Cloud: fixed by Fortinet on Oct 5, 2026
- **CVEs:** CVE-2026-104286
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every FortiMail appliance and VM and check its firmware with get system status.
2. Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later; move 7.2 systems to 7.4.9 or later.
3. If you cannot upgrade today, disable the IBE service (config system encryption ibe, set status disable, end) or remove internet access to the webmail interface.
4. With a WAF in front of FortiMail, block POST requests to /ibe that contain '../' until patched.
5. Hunt for Fortinet's indicators before and after upgrading, because upgrading does not remove anything an attacker already planted.
6. If you find indicators, treat the appliance as compromised: preserve logs, engage Fortinet support, rebuild, and rotate admin passwords and any credentials stored on the device.

### How to check if you are affected

- Search firewall and FortiMail logs for traffic to or from 79.141.169.187 and 45.129.0.192.
- Look for a cron system event running /bin/sh -c with O=/migadmin, and an admin logout with reason=unknown.
- Check the config log for an archive account named 'archive234' with a remote destination of 79.141.169.187 and directory /uploads.
- Look in encryption logs for IBE DecrypterMediaIn BufferException errors ('Invalid Base64 Encoding at pos 0. Character=0x2a').
- Review web or WAF logs for POST requests to /ibe containing '../'.

## What happened

On October 1, 2026, Fortinet published [FG-IR-26-175](https://fortiguard.fortinet.com/psirt/FG-IR-26-175) for CVE-2026-104286, a critical flaw in FortiMail, its email security gateway. A path traversal (CWE-22) and improper handling of NULL bytes (CWE-158) let an unauthenticated attacker "write arbitrary files on the underlying system via crafted HTTP or HTTPS requests." Fortinet rates it CVSS 3.1 9.8 and lists the impact as executing unauthorized code or commands. The advisory says the issue "has been reported to be exploited in the wild."

Fortinet's product security team found the bug internally. The workaround points at the Identity-Based Encryption (IBE) web feature. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286) the same day and gave federal agencies until October 4.

The flaw shipped as a zero-day. When [SecurityWeek](https://www.securityweek.com/exploited-fortinet-fortimail-zero-day-calls-for-urgent-action/) and [Help Net Security](https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/) reported on October 2, no fixed builds were out, only the workaround. Fortinet updated the advisory with fixed releases on October 5 and clarified the FortiMail Cloud status on October 7.

## Who is affected

Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. The fixes are 8.0.2, 7.6.7 and 7.4.9. The 7.2 branch gets no fix, and Fortinet tells those users to upgrade to 7.4 or later. Fortinet updated FortiMail Cloud to 7.6.7 or 8.0.2 on October 5, so cloud customers have nothing to do. The machine-readable product list in the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-104286) also includes 7.0.x builds, which the advisory table and description do not mention. If you still run 7.0, treat it as exposed and move to a supported branch.

## Do you really need to act?

Yes, if you run FortiMail yourself. A mail gateway is internet-facing by design. Its webmail and IBE pages are commonly reachable from the internet so that outside recipients can retrieve encrypted mail. The bug needs no credentials, is under active exploitation, and gives an attacker a write primitive on an appliance that sees all of your inbound and outbound mail. CISA's enrichment on the CVE record marks it automatable with total technical impact.

Fortinet's indicators suggest what attackers do next. They show an archive account named `archive234` configured to ship archives to a remote server at `79.141.169.187`. That suggests mail theft, not just a foothold. Fortinet has not said when exploitation began, how many devices were hit, or who is behind it.

FortiMail Cloud customers and organizations without FortiMail can relax.

## What to do now

1. Check the firmware on every appliance and VM with `get system status`.
2. Upgrade to 8.0.2, 7.6.7 or 7.4.9 or later. Move 7.2 (and any 7.0) systems to 7.4.9 or later.
3. If you cannot upgrade today, disable IBE in the GUI (Encryption > IBE > IBE Service off) or from the CLI: `config system encryption ibe`, `set status disable`, `end`. Alternatively, block internet access to the webmail interface and allow only trusted private networks.
4. If a WAF sits in front of FortiMail, block `POST` requests to `/ibe` that contain `../`.
5. Check the indicators below before and after upgrading. A patch blocks new exploitation but does not remove existing persistence or configuration changes.

## How to tell if you were hit

Fortinet lists these indicators:

- The IPs `79.141.169.187` and `45.129.0.192`.
- A system event log entry with `ui=cron` whose command starts `/bin/sh -c 'O=/migadmin`.
- An `admin` logout with `reason=unknown` from `(null)`.
- A config log entry adding an archive account `archive234` with `remote-ip[79.141.169.187]` and `remote-directory[/uploads]`.
- IBE encryption-log errors reading `Invalid Base64 Encoding at pos 0. Character=0x2a`, alongside `Internal user <address> failed to log in` entries.

Also search web and WAF logs for POSTs to `/ibe` with traversal sequences. If anything matches, assume compromise. Preserve logs and a configuration backup, open a case with Fortinet, rebuild the appliance from clean firmware, and rotate admin passwords, LDAP or directory bind credentials, and other secrets stored on it. Review whether archived mail was sent off-box.

## Timeline

- Oct 1, 2026 — Fortinet publishes FG-IR-26-175 as an exploited zero-day with a workaround only. CISA adds it to KEV, with a federal deadline of October 4.
- Oct 2, 2026 — Press coverage notes that fixed builds 8.0.2, 7.6.7 and 7.4.9 are not yet released.
- Oct 5, 2026 — Fortinet updates the advisory with fixed releases and patches FortiMail Cloud.
- Oct 7, 2026 — The advisory and CVE record are updated with the FortiMail Cloud clarification ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-104286)).

## Sources

1. [Fortinet PSIRT — FG-IR-26-175: FortiMail improper limitation of a pathname to a restricted directory](https://fortiguard.fortinet.com/psirt/FG-IR-26-175)
2. [CVE record — CVE-2026-104286](https://www.cve.org/CVERecord?id=CVE-2026-104286)
3. [NVD — CVE-2026-104286](https://nvd.nist.gov/vuln/detail/CVE-2026-104286)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-104286](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286)
5. [Help Net Security — Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)](https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/)
6. [SecurityWeek — Exploited Fortinet FortiMail zero-day calls for urgent action](https://www.securityweek.com/exploited-fortinet-fortimail-zero-day-calls-for-urgent-action/)

---
Source page: https://erroneo.us/security/briefs/fortimail-ibe-path-traversal-cve-2026-104286/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt