Fortinet Reports Active Exploitation of FortiMail File-Write Vulnerability
Summary
Fortinet reported active exploitation of CVE-2026-104286, an unauthenticated FortiMail file-write flaw that may enable code execution. Patches were pending for affected 7.4, 7.6, and 8.0 deployments; Fortinet published indicators and mitigations.
Key points
- The flaw combines path traversal and improper NULL-byte handling in FortiMail’s Identity-Based Encryption functionality.
- Crafted HTTP or HTTPS requests can let unauthenticated remote attackers write files outside normally permitted directories; Fortinet says this may lead to code or command execution.
- Fortinet reported active exploitation on October 1, 2026; CISA added the vulnerability to its KEV catalog the same day.
- Affected ranges listed are FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1. At disclosure, fixes were pending for 7.4, 7.6, and 8.0; Fortinet identified 7.4.9, 7.6.7, and 8.0.2 as planned fixes.
- Fortinet published indicators including added binaries and modified system or configuration files; organizations are advised to review affected appliances for these signs.
- Mitigations include disabling IBE where feasible and restricting management access to trusted private networks. FortiMail 7.2.x deployments can address the flaw by upgrading to the 7.4 branch or later.
Article Details
- Vulnerability Types
- Path traversal
- Improper handling of NULL byte characters
- Severity
- CVSS 9.8
- Affected Versions
- FortiMail 7.2.0 through 7.2.9
- FortiMail 7.4.0 through 7.4.8
- FortiMail 7.6.0 through 7.6.6
- FortiMail 8.0.0 through 8.0.1
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Disable IBE functionality where operationally feasible.
- Limit access to the FortiMail web management application to trusted private networks.