FortiMail vulnerability CVE-2026-104286: exploited zero-day, versions to install and checks
FortiMail CVE-2026-104286: unauthenticated file write, exploited according to Fortinet and CISA. Fixed in 8.0.2, 7.6.7 and 7.4.9, with interim mitigations and IoCs.
The short answer: CVE-2026-104286 in FortiMail, Fortinet’s email security gateway, lets a remote, unauthenticated attacker write arbitrary files on the appliance through crafted HTTP or HTTPS requests. Fortinet confirms active exploitation, CISA added it to its catalogue of exploited vulnerabilities on 1 October 2026, and Morocco’s maCERT (DGSSI) rated it critical. Upgrade to FortiMail 8.0.2, 7.6.7 or 7.4.9, look for indicators of compromise, and use the same window to apply the FortiOS hardening release published on 22 October.
A FortiMail gateway is, by design, exposed to the internet: it receives the company’s mail and often offers webmail or message encryption. That is exactly the surface being targeted. This alert brings together what Fortinet, CISA, NVD and maCERT say, and the checks to carry out.
What is affected
Advisory FG-IR-26-175, published by Fortinet on 1 October 2026 and updated on 7 October, describes a path traversal flaw (CWE-22) combined with improper neutralisation of the null byte (CWE-158). It sits in the web interface and allows files to be written to the underlying system, with the stated impact of executing unauthorised code or commands.
| Product | Affected versions | Fixed version |
|---|---|---|
| FortiMail 8.0 | 8.0.0 to 8.0.1 | 8.0.2 or later |
| FortiMail 7.6 | 7.6.0 to 7.6.6 | 7.6.7 or later |
| FortiMail 7.4 | 7.4.0 to 7.4.8 | 7.4.9 or later |
| FortiMail 7.2 | 7.2.0 to 7.2.9 | 7.2.10 announced in the advisory; Fortinet and maCERT recommend moving to 7.4 or later |
| FortiMail 7.0 | all | migrate to a fixed release |
| FortiMail Cloud | fixed by Fortinet on 5 October 2026 | no action required |
Source: Fortinet advisory FG-IR-26-175 and maCERT bulletin 69090210/26.
Severity and exploitation
- Published severity: Fortinet assigns a CVSS v3.1 score of 9.8, critical, which NVD also shows. maCERT rates both risk and impact as critical.
- Confirmed exploitation: Fortinet’s advisory states the flaw “has been reported to be exploited in the wild”. CISA added it to its KEV catalogue on 1 October 2026 as “Fortinet FortiMail Path Traversal Vulnerability”, with a 4 October remediation deadline for US federal agencies, which must also carry out forensic triage alongside the fix.
- Practical consequence: exploitation came before some fixes were available. An upgrade therefore does not prove the appliance was not compromised earlier.
Interim mitigations, if the upgrade has to wait
Fortinet and maCERT list three measures, to be treated as temporary:
- Disable the IBE service (identity-based encryption): in the GUI, go to Encryption, then IBE, and turn IBE Service off, or use the CLI under
config system encryption ibe. - Close webmail to the internet or limit it to trusted private networks, and restrict the FortiMail administration interface to trusted networks only.
- Filter upstream: if a web application firewall protects FortiMail, block POST requests to
/ibethat contain../.
Checks to carry out
- Identify the running version of every FortiMail, including virtual machines and standby units, and check which ones are reachable from the internet.
- Look for the indicators of compromise published by Fortinet and repeated by maCERT: connections with 79.141.169.187 and 45.129.0.192, a scheduled job running
/bin/sh -cunder/migadminas root, an administrator logout with an unknown reason, an archive account named “archive234” pointing to a remote server,BufferExceptionerrors in the IBE decrypter. - Check the files listed by maCERT: added
/data/lib/liblog.so,/data/bin/webconsole,/data/bin/mailserviceor/data/etc/ld.so.preload; modified/bin/smit,/data/etc/httpd.confor/data/migadmin.tar.gz. The bulletin provides the matching hashes. - Review the configuration: administrator accounts, archive accounts and destinations, relay rules. Any unexplained change should be handled as an incident.
- If in doubt, isolate the appliance, preserve the logs and, once it is rebuilt, change the secrets it held (administrator accounts, LDAP or directory connectors).
Same month: the FortiOS hardening release
On 21 October 2026, Fortinet announced a coordinated hardening release for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, fixing critical and high-severity flaws found through AI-assisted testing. CVE identifiers and detailed advisories will be published on 10 November 2026. Fortinet reports no exploitation, but warns that patch analysis can help attackers build exploits quickly. maCERT relayed the announcement on 21 October (bulletin 69822110/26, rated critical).
| Product | Affected versions | Fixed version |
|---|---|---|
| FortiOS 8.0 / 7.6 / 7.4 / 7.2 | 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13 | 8.0.2, 7.6.8, 7.4.13, 7.2.14 |
| FortiManager and FortiAnalyzer | 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 | 8.0.2, 7.6.8, 7.4.12, 7.2.13 |
| FortiAuthenticator | 8.0.0-8.0.3, 6.6.0-6.6.10 | 8.0.4, 6.6.11 |
Fortinet recommends starting with internet-facing devices and backing up configurations; until then, restrict HTTPS and SSH administration to trusted addresses, never expose FortiManager to the internet and enforce MFA for administrators. Our method for upgrading FortiOS safely applies directly, as do the 10 security settings for a FortiGate.
Our view for businesses in Morocco
A compromised mail gateway gives access to inbound and outbound mail, and can be used to divert messages or send phishing from a legitimate domain. After fixing it, also check SPF, DKIM and DMARC and watch for unusual outbound mail. An internet-facing appliance needs continuous monitoring: that is the purpose of managed EDR and 24/7 monitoring. For organisations in scope, law 05-20 and DGSSI requirements also require these alerts to be handled. Our Fortinet partner page describes how we support the range.
How we can help
We inventory your Fortinet equipment, apply the fixed FortiMail and FortiOS versions in a controlled maintenance window, look for indicators of compromise and set up 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.
Sources: Fortinet advisory FG-IR-26-175, Fortinet hardening release announcement, CISA KEV catalogue, CISA alert of 1 October 2026, NVD CVE-2026-104286, maCERT bulletin “Zero-day in FortiMail”, maCERT bulletin on Fortinet updates.
Frequently asked questions
Is my FortiGate affected by CVE-2026-104286?
No, this flaw affects FortiMail, Fortinet’s email security gateway. However, on 22 October 2026 Fortinet released a FortiOS hardening release (8.0.2, 7.6.8, 7.4.13 or 7.2.14) fixing critical and high-severity flaws: it concerns every FortiGate and should be scheduled as a priority.
Is the FortiMail flaw really being exploited?
Yes. Fortinet advisory FG-IR-26-175 states that the flaw has been exploited in the wild, CISA added it to its KEV catalogue on 1 October 2026, and the DGSSI’s maCERT published a “Zero-day in FortiMail” bulletin rated critical on 2 October.
Is disabling IBE enough?
No, it is an interim measure. Disabling the IBE service, closing webmail to the internet or filtering requests to /ibe reduces exposure, but only a fixed version removes the flaw. Because exploitation started before the fix, you also need to look for the published indicators of compromise.
We use FortiMail Cloud: what should we do?
Fortinet states it fixed FortiMail Cloud on 5 October 2026 by moving to 7.6.7 or 8.0.2, with no customer action required. It is still worth reviewing administration logs and archiving settings to detect any earlier change.
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
