Fortinet Confirms Active Exploitation of Critical FortiMail Zero-Day

Summary

Fortinet confirms attackers are exploiting an unauthenticated FortiMail path traversal flaw. Most affected branches lack fixes; restrict management access, apply workarounds, and assess exposed appliances for compromise.

Key points

CVE-2026-104286 is an unauthenticated path traversal and NULL-byte neutralization flaw that can enable arbitrary file writes and code execution.
Fortinet and CISA confirmed active exploitation; no actor attribution or reliable public proof-of-concept has been established.
FortiMail versions in the 7.2, 7.4, 7.6, and 8.0 branches are affected. Fixed builds were pending for most branches as of October 2, 2026.
Fortinet recommends disabling IBE or restricting the management interface to trusted networks until fixes are available.
Teams should check exposed appliances for published file, network, and log indicators, preserve evidence, and rotate secrets and rebuild systems if compromise is confirmed.
CISA set an October 4, 2026 remediation deadline for covered federal agencies.

Article Details

Vulnerability Types: Path traversal
Improper NULL byte neutralization
Severity: Critical; CVSS v3.1 score 9.8
Affected Versions: FortiMail 8.0.0 through 8.0.1
FortiMail 7.6.0 through 7.6.6
FortiMail 7.4.0 through 7.4.8
FortiMail 7.2.0 through 7.2.9
Exploitation Status: active
Exploit Availability: none_reported
Patch Status: unavailable
Workarounds: Disable IBE support through the CLI.
Remove the management interface from the internet or restrict it to trusted private networks.

Indicators of compromise

Type	Indicator	Context
IPV4	`45[.]129[.]0[.]192`	IP address Fortinet listed as tied to the activity.
IPV4	`79[.]141[.]169[.]187`	IP address Fortinet tied to the activity; it appeared in a log entry as the remote server for an attacker-created archive account.
SHA256	`4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b`	Hash of the added /data/bin/mailservice file identified by Fortinet as an indicator on compromised appliances.
SHA256	`703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5`	Hash of the modified /data/etc/httpd.conf file identified by Fortinet as an indicator on compromised appliances.
SHA256	`77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a`	Hash of the modified /bin/smit file identified by Fortinet as an indicator on compromised appliances.
SHA256	`7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38`	Hash of the added /data/bin/webconsole file identified by Fortinet as an indicator on compromised appliances.
SHA256	`8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84`	Hash of the added /data/lib/liblog.so file identified by Fortinet as an indicator on compromised appliances.
SHA256	`8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6`	Hash of the added /data/etc/ld.so.preload entry used to load attacker code.
SHA256	`d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3`	Hash of the modified /data/migadmin.tar.gz file identified by Fortinet as an indicator on compromised appliances.