Fortinet has warned that attackers are exploiting a critical FortiMail zero-day to run unauthorized code or commands on vulnerable appliances. The company urges customers to apply temporary protections while they await fixed software releases.
The vulnerability, tracked as CVE-2026-104286, affects the FortiMail management interface and carries a CVSS severity score of 9.8.
Critical Flaw Allows File Writes Without Authentication
According to Fortinet, the vulnerability combines path traversal with improper handling of null characters. Together, these weaknesses allow attackers to write arbitrary files to the underlying system through specially crafted HTTP or HTTPS requests.
Attackers do not need to authenticate before exploiting the flaw. Consequently, exposed management interfaces present an immediate concern for affected organizations.
Fortinet credits Gwendal Guégniaud from its Product Security team with discovering the vulnerability internally. However, the company has not disclosed when exploitation began or how many appliances attackers have compromised.
Four FortiMail Release Branches Need Attention
The vulnerability affects the following versions:
| Release branch | Affected versions | Announced fixed release |
|---|---|---|
| FortiMail 8.0 | 8.0.0–8.0.1 | 8.0.2, upcoming |
| FortiMail 7.6 | 7.6.0–7.6.6 | 7.6.7, upcoming |
| FortiMail 7.4 | 7.4.0–7.4.8 | 7.4.9, upcoming |
| FortiMail 7.2 | 7.2.0–7.2.9 | Migration to a fixed release on a newer branch |
At the time of the October 1 disclosure, Fortinet listed the fixes for branches 7.4, 7.6 and 8.0 as upcoming.
Meanwhile, customers running FortiMail 7.2 need to move to a newer branch for a permanent fix. Simply upgrading to an affected version on another branch would leave the vulnerability unresolved.
Temporary Workarounds Reduce Exposure
Until customers can install a fixed release, Fortinet recommends disabling IBE feature support with these commands:
config system encryption ibe
set status disable
endAlternatively, administrators can block internet access to the FortiMail management interface or restrict access to trusted private networks.
These workarounds address exposure to the FortiMail zero-day. However, applying them does not establish whether an appliance already suffered a compromise.
Attack Indicators Include Modified Files and Archive Settings
Fortinet also released indicators to help administrators investigate suspicious activity. These include newly added files and changes to existing system components.
The listed files include /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice and /data/etc/ld.so.preload. Meanwhile, attackers modified /bin/smit, /data/etc/httpd.conf and /data/migadmin.tar.gz.
The company also associated two IP addresses with the attacks: 79[.]141.169.187 and 45[.]129.0.192.
One published log example shows someone creating an archive account named archive234 through the command line. Its settings point to a remote server at 79[.]141.169.187 and an /uploads directory.
That configuration could indicate an attempt to send archived information outside the organization. However, the log entry alone does not confirm that a transfer succeeded.
Additional examples include a scheduled command involving /migadmin, an unusual administrator logout and an IBE decoding error. Fortinet also included failed login events among the investigation clues.
CISA Sets October 4 Deadline for Federal Agencies
CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog. The agency requires affected federal agencies to perform forensic triage and mitigate the vulnerability by October 4.
Meanwhile, Fortinet says it is coordinating with relevant government organizations, including CISA.
The company has not identified the attackers or disclosed the full scope of the campaign. For now, its guidance focuses on reducing exposure and examining appliances for evidence of intrusion.
0 responses to “FortiMail Zero-Day Exploited as Customers Await Security Updates”