Fortinet Warns of Critical FortiMail Zero-Day CVE-2026-104286 Exploited in the Wild, With Patches Not Yet Released
Overview: A Critical FortiMail Flaw Under Active Attack
Fortinet has warned that a critical vulnerability in its FortiMail email security product, tracked as CVE-2026-104286, is being actively exploited in the wild as a zero-day. The flaw carries a CVSS v3 score of 9.8.
According to BleepingComputer, the vulnerability affects the FortiMail management interface, and attackers are using it to execute unauthorized code or commands. Fortinet published its advisory on October 1, 2026.
What the Vulnerability Is
CVE-2026-104286 combines two weaknesses:
- A path traversal flaw (CWE-22)
- Improper neutralization of a NULL byte (CWE-158)
Together, these may allow an unauthenticated attacker to write arbitrary files on the underlying system by sending crafted HTTP or HTTPS requests. No credentials are needed, which helps explain the near-maximum severity rating.
The flaw was discovered internally by Gwendal Guégniaud of Fortinet's Product Security team.
Affected FortiMail Versions
The following FortiMail releases are affected:
- FortiMail 8.0.0 through 8.0.1
- FortiMail 7.6.0 through 7.6.6
- FortiMail 7.4.0 through 7.4.8
- FortiMail 7.2.0 through 7.2.9
Patch Status: Fixes Planned but Not Yet Available
Fortinet plans to fix the vulnerability in FortiMail 8.0.2, 7.6.7 and 7.4.9. However, none of these versions had been released at the time of reporting, so organizations cannot yet patch.
No fix is planned for the 7.2 branch. FortiMail 7.2 users are advised to upgrade to the 7.4 branch or later.
Workarounds Until Patches Arrive
Until fixed versions are available, Fortinet recommends disabling the identity-based encryption (IBE) feature with the following CLI commands:
config system encryption ibeset status disableend
Alternatively, administrators can reduce exposure by:
- Blocking Internet access to the management interface, or
- Restricting management interface access to trusted private networks
Indicators of Compromise
Fortinet has published indicators of compromise (IoCs) to help administrators check whether their systems have already been breached. These include files added or modified on compromised devices, such as:
/data/lib/liblog.so/bin/smit/data/bin/webconsole/data/bin/mailservice
According to Help Net Security, Fortinet also shared IP addresses and log entries tied to the attacks. Because exploitation preceded any available fix, administrators should review their systems against these IoCs and not rely on workarounds alone.
CISA Response and Federal Deadline
Help Net Security reports that the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog on the same day as Fortinet's October 1, 2026 advisory.
CISA gave US federal civilian agencies until October 4, 2026 to address the flaw. That is a short window, especially since patched versions were not yet available at the time of reporting.
What Remains Unknown
Several key details about the attacks have not been disclosed. Fortinet did not say:
- When or where the attacks were spotted
- How many systems were compromised
- Who was behind the attacks
Until more information emerges, FortiMail administrators should apply the available workarounds, check for the published indicators of compromise, and install the fixed releases as soon as Fortinet ships them.