Critical FortiMail 0-Day Vulnerability Exploited, Patch Available

Key Takeaways

• A critical zero-day vulnerability (CVE-2026-104286) in FortiMail is being actively exploited in the wild.
• The flaw, rated 9.8 CVSS, allows unauthenticated attackers to write arbitrary files onto affected systems.
• Impacted FortiMail versions range across branches 8.0, 7.6, 7.4, and 7.2.
• While patches are forthcoming, Fortinet has provided immediate workarounds and indicators of compromise.

Fortinet has issued a urgent warning regarding a critical zero-day vulnerability within its FortiMail email security platform, confirming active exploitation by malicious actors. The flaw, identified as CVE-2026-104286, carries a severe CVSS score of 9.8, indicating its high potential for impact.

The vulnerability enables unauthenticated attackers to execute arbitrary file write operations on vulnerable devices. This can be achieved by sending specially crafted HTTP or HTTPS requests, bypassing the need for any login credentials.

Fortinet released advisory FG-IR-26-175 on October 1, 2026, urging customers to implement temporary mitigations without delay. At the time of disclosure, security updates for several affected FortiMail branches were still pending release, underscoring the importance of immediate protective measures for organizations operating vulnerable systems.

FortiMail 0-Day Vulnerability Details

The core of this critical vulnerability lies in a combination of two distinct weaknesses: path traversal (CWE-22) and improper handling of NULL bytes (CWE-158). Path traversal vulnerabilities allow attackers to manipulate file paths to access directories beyond their intended scope. In this specific instance, Fortinet indicates that specially crafted web requests can lead to unauthorized file writes on the underlying operating system of the appliance.

The severity of this issue is amplified by its unauthenticated nature; attackers do not require an account to exploit the flaw. Unauthorized file writes on a security appliance can severely compromise its integrity and operational security. Despite confirming active exploitation, Fortinet has not yet publicly detailed the full attack chain, identified specific threat actors, or disclosed the number of organizations affected.

Gwendal Guégniaud from Fortinet’s Product Security team is credited with discovering and reporting this vulnerability internally. The advisory explicitly states that exploitation is occurring in the wild and does not list any virtual patch, emphasizing that administrators should prioritize reducing exposure rather than waiting for further attack specifics.

Affected and Patched Versions

The vulnerability impacts a range of FortiMail versions across multiple branches. Specifically, systems running FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9 are at risk. Fortinet has indicated that upcoming releases 8.0.2, 7.6.7, and 7.4.9, or subsequent versions, will contain the necessary fixes for their respective branches.

For users on the FortiMail 7.2 branch, the vendor strongly advises upgrading to branch 7.4 or a later version, as no direct patch is planned for 7.2. Administrators must ensure they select a truly fixed release, as earlier builds within the 7.4 branch are also vulnerable.

As an immediate workaround, Fortinet recommends disabling IBE (Identity-Based Encryption) feature support. This can be done via the command-line interface by entering config system encryption ibe, then set status disable, followed by end. Alternatively, Fortinet suggests restricting public internet access to the FortiMail management interface or limiting access exclusively to trusted private networks.

Indicators Security Teams Should Check

Fortinet has provided specific indicators of compromise (IoCs) to help security teams detect potential breaches. These include the presence of unexpected files at key system locations: /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and /data/etc/ld.so.preload. Additionally, modifications to existing files such as /bin/smit, /data/etc/httpd.conf, and /data/migadmin.tar.gz should raise immediate red flags. The advisory includes MD5 and SHA256 hashes for these files to facilitate verification.

Two specific IP addresses, 79[.]141.169.187 and 45[.]129.0.192, are also listed as IoCs. Organizations should investigate any configuration logs showing an archive account named archive234, particularly if it’s configured to send archives to 79.141.169.187 under the /uploads directory. This activity warrants thorough investigation in conjunction with any detected file changes or other anomalous behavior.

Further suspicious clues include root cron commands referencing /migadmin, administrator logouts with a null interface value, IBE decryption errors indicating invalid Base64 data, and failed internal-user login attempts. These indicators should be evaluated collectively rather than in isolation to form a comprehensive picture of potential compromise.

What You Should Do

• Immediately apply the recommended workaround: disable IBE feature support via CLI (config system encryption ibe, then set status disable, followed by end).
• Alternatively, restrict all public internet access to the FortiMail management interface or limit access to trusted private networks only.
• Thoroughly investigate your FortiMail systems for the listed indicators of compromise, including unexpected files, modified files, and suspicious log entries.
• Preserve all relevant system and network logs for forensic analysis if compromise is suspected.
• For affected versions, plan and apply the appropriate fixed release (8.0.2, 7.6.7, 7.4.9, or later) as soon as it becomes available. If on branch 7.2, upgrade to 7.4 or later.
• Regularly monitor Fortinet’s advisory for updated guidance and patch availability.
• Review unexpected account changes and outbound connections from your FortiMail appliances as part of your assessment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.