Fortinet has disclosed CVE-2026-104286, a critical (CVSS 9.8) flaw in FortiMail that lets an unauthenticated attacker write arbitrary files through crafted HTTP/HTTPS requests, and confirms it is being exploited in the wild. The fixed releases are listed as "upcoming", so for now the only protection is a workaround: turn off Identity-Based Encryption (IBE) or take webmail off the internet.
What happened
Fortinet published advisory FG-IR-26-175 on October 1, 2026. It describes a path traversal weakness (CWE-22) combined with improper NULL byte handling (CWE-158) in the FortiMail webmail interface and IBE service. Fortinet says the issue was found internally by its Product Security team and flags it as exploited in the wild. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog the same day; BleepingComputer reports the remediation deadline for federal agencies is October 4.
Affected versions, per the advisory:
| Branch | Affected | Fortinet solution |
|---|---|---|
| FortiMail 8.0 | 8.0.0 – 8.0.1 | Upgrade to upcoming 8.0.2 or above |
| FortiMail 7.6 | 7.6.0 – 7.6.6 | Upgrade to upcoming 7.6.7 or above |
| FortiMail 7.4 | 7.4.0 – 7.4.8 | Upgrade to upcoming 7.4.9 or above |
| FortiMail 7.2 | 7.2.0 – 7.2.9 | Upgrade to branch 7.4 or above |
SecurityWeek reports that Fortinet has not given a release timeline for the fixed builds. Until they ship, Fortinet's workarounds are to disable IBE, to block internet access to the webmail interface (or allow only trusted private networks), or, if a WAF sits in front of FortiMail, to block POST requests to /ibe that contain ../.
Fortinet published two attacker IP addresses, 79.141.169.187 and 45.129.0.192, plus log-based indicators. In system event logs: cron entries referencing /migadmin, an admin logout with no source interface (User admin logged out from (null).), and creation of an archive account with remote IP 79.141.169.187. In encryption logs: Base64 encoding errors during IBE decryption and failed internal user logins. BleepingComputer reports that the observed attacks configured archive accounts to send data to those two IPs, and that Fortinet's IOC list covers seven added or modified files, including /data/lib/liblog.so, /bin/smit and /data/etc/ld.so.preload.
Why it matters
A secure email gateway sees every inbound and outbound message, including password reset links, MFA enrollment emails and invoices. The archive-account technique turns the gateway into a quiet copy-everything exfiltration channel that looks like a normal configuration change, not like malware.
It also fits a familiar pattern: internet-facing appliances in front of users and identity flows get hit before a patch exists. A preload library like ld.so.preload pointing at a planted .so is a persistence mechanism that an upgrade alone may not clear. Once fixed builds ship, upgrading closes the hole but does not prove an exposed appliance was never compromised.
What to check in your environment
- Inventory every FortiMail instance, including DR, lab and MSP-managed units, and compare versions against the table above.
- Find out whether IBE is in use. If not, disable it now through the GUI (Encryption → IBE → IBE Service "off") or the CLI command from the advisory:
config system encryption ibe set status disable end - If you need IBE, restrict webmail exposure to trusted private networks, or add a WAF rule that blocks POST requests to
/ibecontaining../. - Review archive account configuration for accounts nobody can explain, especially any forwarding to
79.141.169.187or45.129.0.192. Search firewall and proxy logs for traffic to those IPs too. - Go through system event logs for cron entries referencing
/migadmin, admin logouts "from (null)", and unexpected archive account additions, and encryption logs for Base64 errors in IBE decryption and failed internal user logins. Ask Fortinet support to help confirm whether the file IOCs listed above are present. - If you find indicators, treat it as an incident: preserve evidence before changing anything, and assume mail that passed through the gateway, along with any credentials or reset links in it, may have been exposed.
- Plan the 7.2 migration. There is no 7.2 fix; Fortinet says move to 7.4 or later.
- Watch the advisory for fixed builds (7.4.9, 7.6.7, 8.0.2) and assign an owner to patch within days of release.