FortiMail zero-day CVE-2026-104286 exploited before a patch was available
Fortinet confirms attackers are exploiting a critical FortiMail flaw that allows unauthenticated file writes. Apply the workaround now and check for signs of compromise.
What happened
On 1 October 2026 Fortinet disclosed CVE-2026-104286, a critical vulnerability (CVSS 9.8) in its FortiMail email security gateway, and confirmed it is being exploited in the wild. The flaw combines path traversal with improper handling of NULL bytes. An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files to the underlying system, which can lead to code execution. CISA added it to its Known Exploited Vulnerabilities catalogue the same day.
Who is affected
FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9.
What to do now
- No fixed release was available when the advisory was published. Apply Fortinet's workaround: disable IBE feature support, or block internet access to the FortiMail management interface and allow it only from trusted private networks.
- Install the fixed release as soon as Fortinet publishes it.
- Hunt for compromise. Indicators published by Fortinet show attackers implanting persistent code and changing mail archiving to send copies of messages to attacker infrastructure. Review archiving settings and recent configuration changes.
Why it matters for SOC teams
An email gateway sees every message. A quiet change to archiving rules can leak mail for weeks without triggering a classic malware alert, which is why configuration changes on security appliances deserve the same attention as endpoint alerts. Read our analysis of this month's edge device zero-days.
Sources
Prepared with AI assistance by the Claire Security research team, based on the sources listed.
Catch threats like these around the clock
Claire Security triages every alert with auditable AI, on your own servers.
Request a demo