CVE-2026-104286: FortiMail Arbitrary File Writes
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-01. Federal agencies must patch by 2026-10-04.
TL;DR - CVE-2026-104286 is a critical FortiMail path-traversal vulnerability with a vendor-reported CVSS score of 9.8. - Unauthenticated remote attackers can write arbitrary files through crafted HTTP or HTTPS requests. - Exploitation is confirmed, and the CVE is listed in CISA KEV. - Upgrade affected appliances immediately or disable Identity-Based Encryption (IBE as a temporary mitigation.
Are You Affected?
CVE-2026-104286 affects Fortinet FortiMail appliances running vulnerable 7.2, 7.4, 7.6, and 8.0 releases. The vulnerable component is the FortiMail GUI, and exploitation requires no authentication.
Treat any appliance with an accessible HTTP or HTTPS service as potentially exposed until its software version and network reachability are confirmed.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-104286 |
| Product | Fortinet FortiMail |
| Vulnerability | Path traversal, CWE-22 |
| CVSS | 9.8, vendor-reported CVSS v3 score |
| Attack vector | Remote HTTP or HTTPS requests |
| Authentication | None required |
| Privileges required | None identified; exploitation is unauthenticated |
| Impact | Arbitrary file write; Fortinet describes unauthorized code or command execution |
| Patch available | Yes |
| In-the-wild exploitation | Confirmed by Fortinet and CISA KEV |
| Public PoC | No verified primary-source public PoC identified |
The affected and fixed releases are:
| FortiMail branch | Affected versions | Fixed version or required action |
|---|---|---|
| 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or later |
| 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or later |
| 7.4 | 7.4.0 through 7.4.8 | Upgrade to 7.4.9 or later |
| 7.2 | 7.2.0 through 7.2.9 | Move to the 7.4 branch or later; no dedicated 7.2 fix is identified |
FortiMail Cloud was remediated on October 5, 2026, through firmware updates to 7.6.7 GA or 8.0.2 GA. Cloud customers should still verify tenant status with Fortinet, particularly when internal compliance requires documented confirmation.
The Fix, If You’re in a Hurry
Upgrade self-managed appliances immediately to one of these fixed releases:
- FortiMail 8.0.2 or later
- FortiMail 7.6.7 or later
- FortiMail 7.4.9 or later
Organizations running 7.2.x should plan a migration to the 7.4 branch or later because Fortinet does not identify a dedicated fixed 7.2 release for this issue.
If patching cannot happen immediately, disable the Identity-Based Encryption service. In the GUI, use Encryption → IBE → IBE Service and disable the service.
This workaround reduces exposure to the vulnerable functionality, but it may affect mail-encryption workflows and is not a replacement for upgrading. For background on encryption terminology, see this encryption glossary.
Analyst’s Take: Patch exposed appliances first, then investigate them. Do not treat the workaround as a clean bill of health. Confirmed exploitation and the ability to write arbitrary files make version checks, log preservation, and a review for persistence necessary even when IBE has been disabled.
Technical Notes: Interim Mitigation
Fortinet documents this CLI workaround:
config system encryption ibe
set status disable
end
After applying the workaround:
- Verify the setting through the appliance configuration.
- Restrict administrative access to trusted management networks.
- Preserve logs and system evidence before disruptive remediation.
- Upgrade to a fixed release as soon as possible.
Do not assume that disabling IBE removes evidence of earlier exploitation. Arbitrary file-write vulnerabilities can support persistence, configuration modification, or unauthorized code execution before the service is disabled.
The appliance should not be considered clean solely because the workaround succeeds. Patch the appliance, review indicators, and follow the organization’s incident-response process if suspicious activity is found.
How This Vulnerability Works
CVE-2026-104286 is an improper pathname restriction vulnerability classified as CWE-22 path traversal. The affected FortiMail GUI does not adequately constrain a user-controlled pathname to the intended directory. A remote attacker can send specially crafted HTTP or HTTPS requests that cause the appliance to address a location outside the expected directory.
The resulting capability is arbitrary file writing on the underlying FortiMail system. Fortinet describes the impact as the ability to execute unauthorized code or commands. The vulnerability is especially serious because the attacker does not need a valid account before sending the crafted request.
Available technical information does not establish a single exploit path, exact request format, or reliable public signature. Defenders should therefore avoid relying on a narrowly defined web-request pattern. Detection should combine:
- Appliance version checks
- Access-log review
- Filesystem integrity checks
- Configuration auditing
- Investigation of unexpected processes or files
Fortinet has associated exploitation with persistent code and changes to mail-archiving behavior. A compromised FortiMail appliance may expose sensitive mail traffic, alter mail-processing behavior, or provide attackers with persistence inside an organization’s messaging infrastructure.
Severity, Explained
Fortinet classifies the issue as Critical, and the reported CVSS v3 score is 9.8. The score reflects the combination of remote reachability, lack of authentication, and potentially severe confidentiality, integrity, and availability consequences.
An arbitrary file write on a security appliance can extend beyond a single file and may enable unauthorized commands or code execution.
The complete NVD CVSS vector string was not available in the supplied record. The exact CVSS component values, including attack complexity and user interaction, should not be reconstructed from the score alone. What is confirmed is that exploitation uses crafted HTTP or HTTPS requests and does not require authentication.
Operational risk is higher than the score alone suggests for internet-facing appliances. FortiMail sits on email-processing paths and may handle confidential messages, credentials, encryption configuration, routing data, and administrative settings. Compromise can therefore affect both the appliance and the organization’s communications.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 1, 2026, with a remediation due date of October 4, 2026. CISA lists ransomware campaign use as unknown.
That status does not reduce the urgency. It means only that exploitation has not been attributed to a known ransomware campaign.
Is It Being Exploited?
Yes. Fortinet states that CVE-2026-104286 has been exploited in the wild, and CISA’s KEV listing independently confirms known exploitation.
Organizations should treat every exposed, unpatched FortiMail appliance as a potential incident rather than waiting for a public exploit publication.
No verified primary-source public proof-of-concept repository was identified in the available research. This distinction matters, but it should not affect prioritization. The absence of a confirmed public PoC is not evidence of low risk because real-world exploitation is already confirmed.
There is also no confirmed attribution in the supplied material to a specific threat actor or ransomware campaign. Teams should not treat the lack of attribution as reassurance. Threat actors may use the vulnerability for persistence, espionage, mail interception, or access brokerage without deploying ransomware.
Bottom Line
Patch exposed FortiMail appliances immediately using the appropriate fixed release:
- 8.0.2 or later
- 7.6.7 or later
- 7.4.9 or later
Organizations running 7.2.x should migrate to the 7.4 branch or later. If patching must wait, disable IBE, restrict administrative access, and begin the compromise review immediately.
Confirmed exploitation means investigation remains necessary after remediation, with particular attention to unauthorized file writes, persistence, configuration changes, and mail-archiving behavior.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detecting It in Your Environment
Start with asset and version inventory. Identify every FortiMail appliance, its software branch, exposed interfaces, and whether administrative or GUI services are reachable from the internet.
Prioritize systems running:
- 8.0.0 through 8.0.1
- 7.6.0 through 7.6.6
- 7.4.0 through 7.4.8
- 7.2.0 through 7.2.9
Review FortiMail access and system logs around suspicious HTTP or HTTPS requests, especially requests containing:
- Encoded traversal indicators
- Unusual path components
- Unexpected HTTP methods
- Source addresses that do not normally administer the appliance
Because the available advisory material does not provide a complete vendor detection signature, these patterns are triage signals rather than proof of exploitation.
Technical Notes: Log and Detection Queries
A generic log search for traversal indicators can help identify candidate requests. Adapt field names to the organization’s SIEM and the FortiMail log format:
(index=fortimail OR sourcetype=fortimail)
(protocol=http OR protocol=https)
(uri="*../*" OR uri="*%2e%2e*" OR uri="*%252e%252e*" OR request="*../*")
| stats count min(_time) as first_seen max(_time) as last_seen
values(src_ip) as source_ips values(uri) as requested_uris
by dest_ip http_method
This query is not a definitive CVE signature. Attackers may encode or structure requests differently, and legitimate applications can also contain path-like data.
Correlate matches with:
- Appliance version
- Source reputation
- Authentication state
- Response codes
- Subsequent filesystem changes
- Configuration changes
- Unexpected processes or network connections
Also investigate:
- Unexpected files or recently modified files outside normal FortiMail application directories.
- Unknown binaries, scripts, scheduled tasks, startup entries, or persistence mechanisms.
- Unauthorized changes to mail-archiving destinations or archive behavior.
- New administrative accounts, altered access policies, or unexpected configuration exports.
- Processes or network connections not associated with normal FortiMail operation.
- Sudden changes in outbound mail flow, delivery routing, or message-processing behavior.
Preserve relevant logs and forensic data before rebuilding or upgrading a potentially compromised appliance. If evidence indicates unauthorized code execution or persistence, isolate the system according to incident-response procedures.
Consider rotating credentials and secrets that may have been accessible from the appliance. A password manager such as 1Password can help teams enforce unique credentials during post-incident credential rotation, but it does not replace remediation or forensic investigation.
Incident-Response Checklist
Use the following sequence when a vulnerable or potentially compromised FortiMail appliance is identified:
- Confirm exposure. Record the appliance version, interfaces, internet reachability, and management exposure.
- Contain access. Restrict administrative and GUI access to trusted management networks.
- Apply the workaround if necessary. Disable IBE when immediate patching is not possible.
- Preserve evidence. Export relevant logs and configuration data before making disruptive changes.
- Upgrade. Install FortiMail 8.0.2, 7.6.7, or 7.4.9, as appropriate.
- Review for compromise. Search for suspicious files, processes, accounts, configuration changes, and mail-archiving modifications.
- Rotate exposed secrets. Reset credentials and tokens that may have been accessible from the appliance.
- Monitor after remediation. Continue reviewing logs and mail-flow behavior for signs of persistence or unauthorized activity.
For comparison with other vulnerability response reporting, see our related CVE coverage.
References and Further Reading
The primary Fortinet advisory is FG-IR-26-175, which documents the affected versions, impact, workaround, and fixed releases:
The NVD record provides the CVE entry and vulnerability metadata:
CISA’s Known Exploited Vulnerabilities catalog confirms exploitation in the wild and lists the remediation deadline:
Additional version and workaround discussion is available from WatchTowr: